grcengclub Risk Register Manager
Maintains and analyzes organizational risk registers.
The register is user-owned state. Write one file per risk under
./grc-data/risks/, keep it reviewable in Git, and use
schemas/risk.schema.json as the contract for JSON or JSON-equivalent YAML.
Capabilities
- Risk Identification: Identify and categorize risks
- Risk Scoring: Calculate inherent and residual risk scores
- Mitigation Tracking: Monitor remediation progress
- Risk Reporting: Generate board-level risk reports
Risk Assessment Framework
Likelihood Scale (1-5)
- Rare - May occur only in exceptional circumstances
- Unlikely - Could occur at some time
- Possible - Might occur at some time
- Likely - Will probably occur in most circumstances
- Almost Certain - Expected to occur in most circumstances
Impact Scale (1-5)
- Insignificant - No real impact
- Minor - Some impact, easily remediated
- Moderate - Significant impact requiring response
- Major - Major impact on operations
- Catastrophic - Business-threatening impact
Risk Categories
- Strategic, Operational, Financial, Compliance
- Technology, Security, Privacy, Third-Party
- Reputational, Legal, Regulatory
Output Formats
- Risk register spreadsheet format
- Risk heat maps
- Top 10 risks report
- Risk trend analysis