The workbook worked — until it didn’t
A spreadsheet register is genuinely fine at twenty risks and one owner. It falls apart at the moment you need cross-sheet references to hold, control effectiveness to recalculate, evidence to be attached, and three different people to update it in the same week.
✗The workbook at scale
- Cross-sheet formulas break silently, and nobody notices until the audit.
- Residual risk is whatever was last typed in, not what the controls actually produce.
- Mitigation plans sit on a second tab with no live link back to the risk they treat.
- Evidence is a folder path in a comment, if it is anywhere at all.
- There is one version, one editor, and a very nervous risk manager.
✓The register as a live system
- Residual risk and control effectiveness are calculated from the model every time the inputs move.
- Mitigation plans map to a risk, and the function and risk-to-mitigate fields auto-fetch from that link.
- Evidence is an object in the system, counted on the dashboard and attached to the treatment.
- Every risk has a named owner, a treatment decision and a next review date the platform tracks.
- Revision history under document control shows what changed, when and by whom.
Five stages, five screens, one methodology
The platform mirrors the register your team already knows — it just stops it from drifting.
An executive view that survives a board meeting
Extreme and high risk counts, total risks, open mitigations and evidence on file across the top. Below: severity distribution, control effectiveness, treatment posture as accept, mitigate or transfer, the top risks by inherent priority, and a live 5×5 matrix you can open in full. One screen answers the three questions a board always asks.
The register itself, with the maths done for you
Each risk flows through the same five stages as the source workbook. IL-PL drives inherent score, the selected control and its ML and MF factors drive residual, and control effectiveness falls out of the model. A treatment decision links the risk to a mitigation plan — the link is real, not a text reference.
1,239 controls, ready to select
A complete control library spanning 34 domains — cybersecurity and data protection governance, access control, asset management, business continuity, cloud security, cryptographic protections, data privacy, endpoint security, human resources security, incident response, and artificial and autonomous technologies among them. Search by code or text, filter by domain.
Mitigation plans wired to the risks they treat
Plans carry the action, due date, responsible officer, approver and status. The function and risk-to-mitigate columns auto-fetch from the linked risk exactly as the source workbook’s cross-sheet references intended — except here the reference cannot break.
A risk taxonomy your auditors will recognise
Risk domains and control-deficiency risks, each entry describing precisely what the organisation is exposed to if the corresponding control fails — from inability to maintain individual accountability, through privilege escalation, to emergent consequences from AI and autonomous technologies. These feed the category dropdown in the register.
Take the full tour
Five screens from the working platform.
Built for the way risk work actually runs
Live risk matrix
A 5×5 probability-by-impact matrix with counts in each cell and drill-through to the underlying risks.
Inherent and residual scoring
Both scores calculated from the model, so the reduction claimed is the reduction the controls produce.
Evidence list
Artifacts registered against treatments, counted on the dashboard, so “evidence on file” is a number and not a hope.
Revision history
Full document control — every change to the register recorded with author and timestamp.
Excel export everywhere
Every screen exports to Excel, so the register still works for the people who insist on a workbook.
Analytics
Trend the register over time: risks opened and closed, treatment mix, control effectiveness and the residual profile by domain.
Review scheduling
Each risk carries a next-review date, and outstanding risks surface before they age out of relevance.
Risk owners view
Every owner sees their own risks, their outstanding mitigations and what is due — without a chase email.
Incident feed-in
Control deficiencies found during an incident review land here directly from Onva Incident Command.
Made to satisfy an assessor
The register is only useful if a third party will accept it. Every element below exists for that conversation.
We start from your register, not a blank one
Import
Your existing workbook is loaded as-is — risks, scores, controls, plans and owners — so nothing is retyped and nothing is lost.
Preserve
The scoring model, matrix and category taxonomy are configured to reproduce your current numbers exactly before anything changes.
Extend
Controls are mapped to the 1,239-control library, evidence is attached, and mitigation plans are linked to their risks.
Govern
Owners get their views, reviews get scheduled, and the register becomes something the board reads rather than something the risk manager rebuilds.
Straight answers
Not unless you ask it to. The first phase reproduces your existing methodology exactly — same matrix, same factors, same scores. Only once the numbers reconcile against your current register do we look at whether the model itself should change.
It is a consolidated control set spanning 34 domains, covering governance, technical and operational controls including cloud, cryptography, data privacy, endpoint, human resources security, incident response and AI and autonomous technologies. You can select from it, extend it, or map your own control framework onto it.
Yes. Every screen has an Excel export, and imports run the other way. Teams typically keep exporting for a quarter or two, then stop because the live register is easier to trust.
From the selected control and its mitigation likelihood and mitigation factor inputs against the inherent score. The residual figure and the effectiveness band are both derived — neither is typed in — so a claimed reduction is always backed by the model.
Yes. The taxonomy covers operational risk domains generally — business continuity, asset management, capacity and performance, compliance, human resources and third parties among them — so the same register carries operational and technology risk side by side.
Send us your register. We will show you it running.
Upload your existing workbook and we will stand up a private instance with your own risks, scores and controls loaded, so the demonstration is about your register rather than a sample one.