A risk register your auditors trust.
Every risk is captured the same way, scored by one engine, mapped to the controls it threatens and tracked through eight visible stages, with a history nobody can rewrite.
| ID | Risk | Severity | Status |
|---|---|---|---|
| R-1042 | Dormant accounts in directory | High | Open |
| R-1041 | Unencrypted DB credentials in config | Critical | Open |
| R-1038 | Offboarding tickets breach SLA | Medium | Mitigate |
| R-1035 | No SBOM for customer portal | High | Open |
| R-1031 | Overlapping firewall rules | Low | Accepted |
Illustration with sample data
What Risk Register & Intake does
Risk Intake is the heart of RiskVantis. You can log risks one at a time, import them from a file, create them from findings or receive them from other modules. Each risk is scored on 13 risk vectors plus likelihood and impact, giving inherent, residual and target scores with configurable severity and priority bands. A Risk Owner is accountable and an Action Owner does the work. You can propose several Action Owners, and the first to accept takes ownership.
On the first save, AI maps the risk to the controls of the frameworks you choose, and each suggestion carries a rationale and a confidence. An advisory AI Treatment Plan suggests ordered tasks and a target score for you to edit before anything is added. Closure progress rolls up automatically from tasks, sub-tasks and linked findings. Every field change, assessment and progress note is kept, and a deleted risk with its linked work can be restored from the Recycle Bin within 10 days.
Key capabilities
One scoring engine
13 risk vectors plus likelihood × impact for inherent, residual and target scores, with every calculation versioned.
8-stage tracker
Identified → Evaluation → Security Review → Review → Final Review → Treatment → Monitoring → Closed, visible on every risk.
Automatic control mapping
AI maps each new risk to framework controls with a rationale and confidence; Secure Controls Framework equivalents are added through a crosswalk.
AI treatment plan
Suggested tasks, treatment option and target score that you edit or untick before saving.
Live closure progress
Closure % rolls up from sub-tasks to tasks to findings to the risk. The planned date can't be earlier than the work behind it.
Complete audit trail
Field-level change history, assessment history that can't be edited, progress log, escalations and a reasoned reopen.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Risk Register & Intake changes for your programme.
Less effort per risk cycle
Automatic scoring, mapping, treatment drafting and closure roll-up remove most of the manual work of a spreadsheet register.
Repeatable risk assessment
Consistent scoring, documented owners and treatment decisions support clause 6.1 and its equivalents.
Framework impact per risk
Map a risk once and see its impact on every framework that shares the affected control.
Accountability split from execution
The Risk Owner and Action Owner are always different people, and ownership requests are reminded after 2 business days.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Capture
Log, import, synthesise from findings or receive risks from other modules.
Score and map
The engine scores the risk; AI proposes control mappings for you to confirm.
Plan treatment
Draft the plan with AI, assign owners and submit through your workflow.
Track to closure
Closure progress, monitoring and the stage tracker update as work completes.
Supports your obligations.
Risk Register & Intake contributes evidence and coverage to these frameworks and regulations.
Common questions.
Can we import our existing risk register?
Yes. Import from a file to migrate an existing register, then continue working in RiskVantis.
Does AI score or change risks on its own?
No. Scores come from a deterministic engine. AI only proposes control mappings and treatment plans, and a person confirms them. Changes in context raise reassessment proposals rather than silent rescoring.
Is sensitive risk data sent to AI?
Not if the risk is classified Restricted: the content of a Restricted record is never sent to an AI provider.
Works better together.
Risk Treatment Workflows & Approvals
Choose how a risk becomes Active, such as the Risk Team defining the plan or the Action Owner defining it for Risk Owner and CISO approval. Every plan is versioned,…
Learn more →Risk ManagementRisk Intelligence & Appetite
When intelligence, firewall rules, linked records or a control's compliance status change, RiskVantis proposes a reassessment with a preview of the new score. It flags…
Learn more →Risk ManagementFindings Management
Track every gap raised by audits, assessments, scans, control tests and connected systems. Give each one owners and an approved remediation plan, and let AI turn…
Learn more →See Risk Register & Intake in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.