Risk Management

The Risk Management domain provides risk identification, assessment, mitigation tracking, and governed exception management.

---

Key Modules

1. Risk Register (/risks)

Maintains identified enterprise risks, calculates inherent and residual risk ratings, and links mitigating controls.

2. Findings Register (/findings)

Logs compliance deficiencies and audit findings with root cause analyses and links to remediation action plans.

3. Action Plans (/action-plans)

Tracks structured remediation projects, milestone tasks, assigned owners, and committed completion deadlines.

4. Governed Exceptions (/exceptions)

Governs risk acceptances and policy exceptions with mandatory compensating controls, justification reviews, and time-bound expiry.

5. RCSA Campaigns (/rcsa)

Executes periodic Risk and Control Self-Assessment campaigns across business units.