Five stages, one register, nothing retyped between them.
Identification through to formal acceptance, in the order the standard sets out, with every derived field computed on the server and every decision attributed to a person.
Method: ISO/IEC 27005:2022 · Controls: ISO/IEC 27001 Annex A · Techniques: IEC 31010
Attackers can hide their activity on compromised systems because monitoring is manual and reactive.
End to end
The whole page, in five lines.
Identify
Answer the Annex A questionnaire. Every gap drafts a risk, already phrased as a threat and already tied to its control reference.
Source: questionnaire · 93 controlsAnalyse
Likelihood and impact on your own scale. Asset value, exposure factor and rate of occurrence in your own currency.
Method: ISO/IEC 27005:2022Evaluate
Score, priority band and annualised loss expectancy, computed on the server against the appetite your board approved.
Derived fields: read-onlyTreat
Accept, modify, transfer or outsource, each with a named owner, a control, a date, and a flag when no budget is attached.
Owner: a person, not a delimited stringAccept and report
Risk owners confirm the scores. The CRO formally accepts residual risk. The cycle locks and the trail closes behind it.
Clause 6.1.3 · a person signsSpecimen
The questionnaire writes the first draft of the risk.
Answer a control question Non-compliant and a threat-phrased risk drops into a review queue, pre-scored and referenced. Answer Compliant and nothing happens.
Attackers can hide their activity on compromised systems because monitoring is manual and reactive.
| Suggested asset | Core banking platform |
| Proposed likelihood | 5 |
| Proposed impact | 4 |
| Computed priority | P1 |
Nothing reaches the live register until a consultant promotes it. The automation drafts. A person still decides, and the trail records which person.
Derived fields
Six fields nobody can type over.
Score, level, estimated risk value, weight, priority and annualised loss expectancy are written by the scoring service alone. They appear in no form, accept no request, and cannot be sorted into a different answer.
| Field | Value | Source | Editable |
|---|---|---|---|
| Risk score | 25 | likelihood x impact | No |
| Risk level | Very high | banded on score | No |
| Estimated risk value | 9,000,000 | asset value x score | No |
| Risk weight | 125 | per scoring profile | No |
| Risk priority | P1 | banded on weight | No |
| Annualised loss expectancy | 9,720,000 | value x exposure x rate | No |
Clause 6.1.3 requires a person, not a platform.
ISO 27001 clause 6.1.2 requires the organisation to identify risk owners. Clause 6.1.3 requires those owners to approve the treatment plan and formally accept the residual risk. A consultant cannot accept residual risk on a bank's behalf, which is why your department heads get their own logins and why an assessment is not finished until they have signed it.
The unglamorous parts
The parts that decide whether it survives contact with an audit.
Your existing worksheet, read honestly
We import the register you have. Rows whose calculated fields were overwritten are flagged for re-scoring rather than imported as though they were sound.
Queued job · validation reportBoard-ready PDF and editable DOCX
Branded, structured the way a board pack expects, and produced from the live register rather than retyped into a template.
Cover · legend · registerYear two is a comparison, not a rewrite
Every risk belongs to a dated cycle, so the second assessment measures movement instead of starting from an empty file.
Period over periodAppend-only, with no update path and no delete path
Who changed a rating, when, from what to what, on whose authority. The record a spreadsheet structurally cannot produce.
Evidence for the examinercurrent register
Run it against your own register.
We import what you have today, recompute every derived field, and show you which rows the file can prove and which it cannot.