Rated before treatment, rated again after, and honest about the difference.
Three registers that usually live in three places. Risks, with a likelihood and an impact recorded twice — once as they stand, once after the treatment has actually been done. The controls that hold them down, each with an implementation state and a dated effectiveness check. And the legal, regulatory and contractual obligations the business itself has to meet.
Most stop after the rating. The two that follow are what turn a list into a decision somebody made.
What could happen, and whose risk it is — a named person, because an unowned risk is a sentence nobody acts on.
Likelihood against impact, on a five-by-five grid, before any treatment. That is the number most registers never record.
Mitigate, accept, avoid or transfer — with a plan, and a control if you are mitigating.
Rate it again once the treatment is real, and record who accepted what is left. That name against it is the point of the exercise.
Grace draws the heat map twice, side by side: once on the inherent ratings and once on the residual. Put next to each other, the pair is a picture of what your controls are actually worth — which neither grid tells you on its own.
And a risk you rated once and never revisited is carried at its inherent rating in the residual grid, not quietly dropped out of it. The caption says how many are being carried that way. A tool that let unreviewed risks fall off the second grid would show you a business getting safer by not looking.
Risks of every kind live here — safety, supplier, security, strategic — not only the ones a certification asks about. A risk attaches to the process, supplier or system that carries it, so the register is joined to the work rather than parallel to it.
Illustration — not a real workspace.
Preventive, detective, corrective or directive. Four words that decide whether a control stops a thing or merely notices it.
Planned, implemented, operating, or needs improvement — kept apart from effectiveness, because a control can be running and useless.
Effective, partially effective, ineffective, or not assessed. Not assessed is a state in its own right rather than an empty cell.
The date it was last assessed, and the date it is next due. The next one reaches the owner's weekly email when it passes — the other is a record of the past, and nothing falls due about it.
ISO 27001 asks for a real information-security risk assessment, and Grace will not sell you the ISO 27001 module without this one — the dependency is in the product, not a recommendation. The risk register is what that clause is asking to see.
Obligations and controls map to clauses the same way every other record does, so a control that implements a requirement counts toward that framework's readiness and turns up in its evidence pack. Nothing is entered twice.
You classify risks under a taxonomy, and you do not have to invent one. Two starter taxonomies ship with Grace — a full business risk taxonomy and a compact version for a smaller register — and you adopt one into your workspace and edit it from there. The adopted copy records which template and which version it came from, so when we improve the template you can be offered the newer one rather than discovering it by accident.
Illustration — not a real workspace.
It does not score risk for you. Likelihood and impact are your judgement, recorded with a date and a name against them — which is the only thing that makes a rating defensible to anybody who asks. A tool that computed the rating would be computing your opinion.
It does not subscribe to a threat feed, and nobody is watching the world on your behalf. What it does is make sure what you already know is written down, owned, treated, re-rated and brought back before it goes stale.
A five-by-five grid is a convention, not a measurement. It is useful because it makes two people argue about the same thing in the same words, and it is not a probability.
It ships starter taxonomies, not a control library and not a register of obligations. Those two are specific to your business and your contracts — we will help you build them as consulting work, and they are not a data set anybody can hand over honestly.
And adopting a taxonomy is a starting point, not an answer. A borrowed taxonomy you never edit is the one nobody recognises in a meeting, which is why the copy is yours to change rather than a list we keep control of.
A spreadsheet, a page of a board paper, or nothing at all. Thirty minutes is usually enough to tell whether this is worth $100 a month to you.