What the review covers
The review contains 24 questions across governance, risk, controls, obligations, suppliers and resilience. They prompt a proportionate discussion and evidence record. They are not an exhaustive catalogue of the duties that apply to a particular organisation.
Response states
- Implemented: the user reports a control is operating. An evidence reference is requested; no independent verification occurs.
- Partial: some elements operate, with work remaining.
- Missing: a control or process is absent.
- Unknown: the position requires investigation.
- Not applicable: excluded only when a reason is recorded.
- Unanswered: not assessed, and never treated as successful.
Completion and coverage
Completion is valid answers divided by 24. An exclusion without a reason is incomplete. Self-reported coverage is shown only after all 24 questions have valid responses and at least one remains applicable. Implemented contributes 1, partial 0.5, missing and unknown 0; reasoned exclusions are removed from the denominator. The percentage is a simple editorial indicator and is not a compliance score.
All exclusions produce no rating. Missing evidence references remain separately visible even where a control is reported implemented. A complete review can still identify serious gaps.
Priorities and dates
Missing controls lead to “Act”, partial implementation to “Improve”, unknown responses to “Investigate” and absent evidence to “Check evidence”. These are suggested workflow labels. They do not determine legal urgency or replace a professional assessment of severity. Users assign target dates; statutory, regulatory, contractual or incident deadlines must be assessed separately.
Risk matrix
The risk register uses an illustrative 1–5 likelihood scale multiplied by a 1–5 impact scale. Scores 1–5 are Low, 6–14 Medium and 15–25 High. These labels are editorial planning aids, not regulator-prescribed thresholds or automatic acceptance criteria. Define each scale for your organisation before use. Controls may affect likelihood, impact, both or neither; reduced residual ratings require a recorded evidence explanation.
Evidence and verification
References to evidence are supplied by the user. None of the tools opens documents, inspects technical controls, tests systems, submits reports or notifies regulators. “Closed after recorded review” remains a user declaration supported by the text they enter, not verification performed by this site.
Connected workspace and board pack
The connected workspace links risks, controls, obligations and actions through record references. It displays open and overdue actions, failed controls, controls with exceptions, untested controls, missing evidence and records without owners separately. An empty workspace is an unstarted review, not a favourable result. Its board pack reports the entered records, scope, narrative and decisions; the software does not decide materiality or provide an assurance opinion.
Within this workspace, reducing a residual risk score requires an assessment note and a linked control with evidence and a reported result of Effective or Exceptions. This is an editorial data-quality gate, not proof that the reduction is justified. Controls reported effective and actions recorded closed also require evidence text. A user must assess the relevance, sufficiency and reliability of that evidence.
Workspace backups use their own versioned format and are distinct from the standalone register exports. Keep at most 300 records and a backup below 2 MB. The optional fictional example retains a demonstration marker through saving and export; begin a clean workspace for actual records. Control-library downloads are illustrative template working copies and remain marked as untested examples.
Keeping your records
Default state is memory-only in the current page. Save on this device is an explicit choice and creates a local browser copy; it is not a secure team repository. Export a working copy for continuity. Treat downloads and printouts according to your organisation’s information-handling rules. See privacy and storage.