Residual risk is typed in by hand.
It ends up low because it “feels” controlled. Nobody knows who changed a cell or when, and a serious risk with no plan alerts no one.
Your risk register, calculated and traceable.
Record what can go wrong, measure how serious it is, decide what to do and prove you did it.
- For private companies and for Colombian public entities (DAFP v7 profile)
- Seven risk types, from information security to AI and privacy
- The AI proposes, a person decides
Takeover of the cloud console with a stolen admin account
- InherentExtremeP 3 × I 5
- ResidualModerateP 2 × I 3
- The application calculates the residual from the rated controls. Nobody types it in.
View with the Risk test organization: a cloud software company. This is not customer data.
The spreadsheet holds up until the audit.
A matrix in Excel works until there are more than twenty risks, several people or an auditor asking how each number was reached.
Residual risk is calculated.
You rate the controls that already exist against your organization's criteria and the application calculates how much they lower likelihood or impact. Every change is logged with author and date. A High or Extreme risk with no action plan and no signed acceptance stays flagged until it is dealt with.
Seven steps, in the order the standard sets.
Rules first, risks second. It is the order ISO/IEC 27005 asks for and the one the application follows.
Context and criteria
Methodology, control criteria, zone matrix and objectives. Set once, before any assessment.
What is protected
Processes and assets in 11 categories, from information to credentials and AI systems.
Identification
What can happen, why and how: asset, threat, vulnerability, what is lost and its owner.
Inherent assessment
Likelihood and impact before controls. Impact is measured on four dimensions and the highest one counts.
Controls and residual
You rate the existing controls and the residual is calculated from them.
Treatment or acceptance
A High or Extreme residual requires an action plan or a signed formal acceptance.
Monitoring and reports
Panel, heat maps, executive board, exports and log, with each risk's review date.
A new organization starts in setup mode: the “First steps” page guides it through nine steps until it can create its first risk. Guide: how a risk is assessed, step by step.
From Extreme to Moderate, with the working shown.
Every assessment keeps its explanation: where the likelihood came from, which impact dimension decided and how much each control contributed. That is what the auditor reads.
Takeover of the cloud console with a stolen admin account
- InherentExtremeP 3 × I 5
- ResidualModerateP 2 × I 3
- The application calculates the residual from the rated controls. Nobody types it in.
- Cause
- Password theft or guessing, exploiting the lack of a second factor.
- Inherent
- Likelihood 3: once a year. Impact 5: the highest of financial 4, reputation 5, legal 4 and operational 5.
- Preventive control
- Access rules for information and systems. 55.5 points: lowers likelihood by one level.
- Corrective control
- Information backups. 62 points: lowers impact by two levels.
- Action plan
- Mandatory hardware security key on admin accounts and a quarterly permissions review.
- Review
- Moves from a monthly review to a review every three months.
What each zone requires
- LowAccepted as isReviewed every 6 months
- ModerateReduced, or accepted with monitoringReviewed every 3 months
- HighAction plan or formal acceptanceReviewed every 2 months
- ExtremeAction plan or formal acceptanceReviewed every month
The zone matrix adjusts to each organization's risk appetite. Changing it does not rewrite past assessments, and the change is logged. Glossary of terms.
Seven risk types, each with its own questions.
In cybersecurity the attacker's technique matters; in legal risk, the exact rule; in privacy, the person affected; in AI, the model and the data it receives. A generic form would leave those questions unasked.
| Code | Type | What sets it apart | Supporting frameworks |
|---|---|---|---|
| RSI | Information security | Threat and vulnerability from our own catalogue, filtered by asset category. | ISO/IEC 27001 · ISO/IEC 27005 |
| RCS | Cybersecurity | Also a cyber cause from the catalogue and, optionally, the CVSS score and the attack technique. | MITRE ATT&CK · CVSS · NIST CSF 2.0 |
| RJU | Legal or regulatory | The specific legal obligation that would be breached. | Colombian Laws 1581 of 2012 and 1712 of 2014 |
| RIA | Artificial intelligence | False answers, bias, data leaking to the provider or manipulation of the model. | ISO/IEC 42001 · ISO/IEC 23894 · NIST AI RMF |
| RPR | Privacy | Two axes: harm to the organization and harm to the data subject. | Colombian Law 1581 of 2012 · ISO/IEC 27701 |
| RTE | Technology | Failures that are not attacks: a provider outage, obsolescence, configuration errors. | ISO/IEC 27001 · ISO 22301 |
| ROP | Operational | Process and people failures: human error, dependence on a key person, internal fraud. | ISO 31000 · Colombia's public-sector guide |
One profile for private companies, another for public entities.
Our own methodology, on a 1 to 5 scale.
Your organization decides which questions rate its controls and how much each one weighs, separately for preventive and corrective controls. The zone matrix and the financial impact method are yours too.
- Built on ISO 31000, ISO/IEC 27005 and ISO/IEC 27001
- Also works for a one-person company: whatever is signed by its own author is visibly declared
DAFP v7 profile, with the guide's own arithmetic.
The Comprehensive Risk Management Guide for Public Entities from Colombia's Función Pública, version 7 (2025): its likelihood and impact tables, its control attributes and its cumulative reduction. Guide: version 7, explained
- General Report and Treatment Plan with the guide's columns, in Excel and PDF
- Drafts stay out of reports unless you decide otherwise on each export
The AI proposes scenarios and controls. You confirm each one.
From your organization's profile (sector, size, technology) the AI suggests what can go wrong and what controls it. It saves drafting time; the judgement stays with your people.
- Nothing it proposes counts until a person confirms it, one by one
- Personal data is never sent to the AI
- Your organization authorizes it in writing, with an owner, a date and a monthly spending cap
- It can also decline it: the application works in full without AI
House ruleTAoI proposes, a human approves.It applies to a management system document and to a risk scenario alike
Governance and evidence
- Six roles: administrator, management, risk manager, process lead, legal and read-only auditor
- Whoever drafts the acceptance of a critical risk does not approve it: the manager signs, then top management
- The log cannot be edited or deleted; what was already used is retired and stays in the history
- Each organization sees only its own data: it is separated in the database
What comes out of the application.
Every report starts from the same data read, so their counts match one another.
For management
- Executive board by strategic objective
- Red risks per objective and how many are addressed
- Heat maps before and after controls
- Executive report in Word and PDF
For the auditor
- Each risk's statement on a single page
- The written explanation of every assessment
- Acceptances with their minutes and signatures
- Log with author and date of every change
For day-to-day work
- Risk register with filters and CSV export
- Excel detail with controls and plans
- Plan status: overdue, due soon, in progress
- Each risk's next review, calculated automatically
Risk comes in through the same pilot.
One organization at a time, with a member of the team supporting the setup. Leave your email and we will write when your seat opens.
Boarding pass · 2026 pilot
Reserve your Risk seat.
What happens after you reserve
- We write when your seat opens. No marketing emails.
- A 30-minute call to get to know your company.
- You choose a standard, Risk or both, and we explain the terms before any commitment.
- No card and no commitment when reserving
- Your email, protected under Law 1581: we delete it when you ask
Questions about Risk
Does Risk help me certify to ISO/IEC 27001?
It covers what ISO/IEC 27001 requires of risk assessment and treatment: written criteria, comparable assessments, an owner per risk, controls referenced to Annex A and acceptance of residual risk by the right person. The certificate is granted by an accredited body; Risk leaves the evidence ready for that audit.
We are a public entity. Does it work for us?
Yes. The public profile calculates with the arithmetic of Colombia's Función Pública guide, version 7, and exports the General Report and the Treatment Plan with its columns.
What is sent to the AI?
The organization's profile: sector, size, technology. Never names, documents or personal data. The AI is only switched on with written authorization and a spending cap, and every request is recorded.
Do I need to be pursuing certification to use Risk?
No. Risk can be used on its own. If you are also building your management system, it supports what every standard asks for in planning: thinking about risk and leaving evidence.
How do I start?
You reserve your seat with the form on this page. When it opens, we write to schedule a 30-minute call: we get to know your organization, explain the terms before any commitment and create your account. If you would rather talk first, write to us on WhatsApp.