How provable is your risk assessment?

A two-minute self-assessment. Find out where your register sits on the path from a static record to examination-ready — and what moving up requires. We never see your register.

Assists, never certifies.

Answer a few plain questions about how you maintain your register today. We don’t ask for — and never store — your actual register contents.

Question 1 of 10

Where does your risk register live today?

Question 2 of 10

Can you see the full history of changes to any given risk?

Question 3 of 10

Is your register a single structured system, or spread across disconnected places?

Question 4 of 10

How do you know a listed control is actually effective?

Question 5 of 10

Have you ever found a control that existed on paper but not in practice?

Question 6 of 10

Are your mitigations independently challenged for effectiveness?

Question 7 of 10

If a regulation changed tomorrow, how would you know which risks it affects?

Question 8 of 10

How current is your register at any given moment between reviews?

Question 9 of 10

If an examiner asked you to prove your assessment was current and accurate on a specific past date, could you?

Question 10 of 10

Is your change history tamper-evident?