5 by 5 matrix
Heat map for inherent and residual risk, filterable by owner, asset or entity.
L5VAULT / F-06
Home / Platform / Risk Register
Risk RegisterA risk register that stays alive after the audit.
Capture risks with likelihood, impact, owners, treatments and review dates. Link each risk to the controls that reduce it, so residual risk moves when evidence does.
risk-register
IDRiskL x IOwnerTreatmentReview
R-012Leaver access not revoked same day4 x 4 = 16Head of ITHRMS-triggered deprovisioning15 Jan
R-019Production database in a single region3 x 5 = 15CTOCross-region replica30 Jan
R-007Invoice fraud via phishing of finance staff4 x 3 = 12CFOSimulated phishing, payee checks12 Feb
R-023Personal data shared with vendor without DPA3 x 4 = 12ProcurementBlock onboarding without DPA20 Dec
R-031Unencrypted laptop lost in transit2 x 3 = 6IT OpsMDM disk encryption05 Mar
HOW IT WORKS
Four steps, then it runs on its own.
- 01
Identify
Start from a library of common risks for your sector or add your own.
- 02
Score
Rate likelihood and impact on a 5 by 5 matrix for inherent and residual risk.
- 03
Treat
Choose to mitigate, transfer, avoid or accept, with an owner and target date.
- 04
Review
Scheduled reviews keep the register current. Management review packs export in one click.
CAPABILITIES
What Risk Register does for you.
Linked to controls
When a linked control fails, the residual risk is flagged for review.
Clear ownership
Each risk has an owner and treatment owner with reminders before due dates.
Risk acceptance
Formal acceptance with approver, rationale and expiry date.
Asset inventory
Link risks to assets and data categories, including personal data under DPDP.
Management review
Export the register and treatment status for leadership and board reviews.
IN DETAIL
What auditors look for
A defined method
ISO 27001 clause 6.1.2 expects a repeatable risk assessment method with acceptance criteria.
Treatment plans
Clause 6.1.3 links treatment to controls and the Statement of Applicability.
Regular review
Risks reviewed at planned intervals and when significant changes occur.
QUESTIONS
About Risk Register
Can we import our current register?
Yes. Import from a spreadsheet and keep your existing IDs.
Can we change the scoring scale?
Yes. Configure scales and acceptance thresholds to match your method.
Is it only for ISO 27001?
No. The same register supports SOC 2 risk assessment and DPDP privacy risks.
L6 / DATA CORE
Seal the core.
Connect up to three tools and see exactly where you stand against one framework. Free, read-only, and live in about fifteen minutes.
Start readiness check freePrefer to walk through scope first? Contact us