ROPARC product · Compliance & risk
Operational Risk Assessment
Every risk assessed, every decision on record.
Operational Risk Assessment takes the risk register out of the spreadsheet and into ROPARC: assets, threats, vulnerabilities, treatments and controls linked into one chain, worked as fast as a spreadsheet and kept with the review, approval and history of a controlled system.
An add-on product, licensed separately from your ROPARC subscription. Contact us for pricing.
Why it exists
A risk register in a spreadsheet is a snapshot, not a system
Most organisations already assess their risks. The assessment lives in a workbook, it is refreshed before the audit, and the treatments it calls for are tracked somewhere else, if at all. Operational Risk Assessment keeps the familiar sheet and puts a system underneath it.
A workbook on a share
- One copy per assessor, merged by hand
- Scales explained in a tab nobody opens, so scores drift
- Treatments listed, but owned and followed up elsewhere
- No record of who accepted a risk, or when
- Controls justified from memory when the auditor asks
A register in ROPARC
- One live register, edited by everyone at once
- Defined scales, with each level's meaning shown as it is picked
- Treatments as tracked work with an owner, a date and a status
- Acceptance as an approval step, kept in the history
- Every control linked to the risks and treatments that need it
Every asset, risk, treatment and control is an item in ROPARC, so the register gets what every item gets: links you can trace in both directions, workflows with guards, and a history where every change is a commit. The sheet is a view of that system, which is why it can be both fast to work in and safe to audit.
How it works
From asset to control, in one chain
The method follows the order the standards describe: know your assets, assess the risks to them, treat the ones you cannot accept, and show which controls you rely on. Each step links to the one before, so the chain can be followed from any end.
Step one
Know what you protect
A risk is always a risk to something. The assessment starts from an inventory of the assets that matter, and of the concrete things that make them up.
- Asset inventory Information, software, hardware, services, people and locations, each with an owner, a classification, a state and whether it holds personal data.
- Asset instances The real servers, laptops, environments and vaults behind an asset, with an identifier and a custodian, linked to the asset they belong to.
- Asset report Assets by category and state, and every asset with the risks analysed against it, on dashboards that read the inventory live.
Step two
Assess the risk
Each risk names the asset it threatens, the threat and the vulnerability it exploits, and is scored on scales your organisation defined once, so two assessors reach the same number.
- Threat and vulnerability libraries Pick from libraries of common threats and vulnerabilities rather than writing them from scratch, and extend them with your own.
- Scales with a definition Impact is a loss in euros, probability a frequency. Every level carries its definition, and the definition is shown at the moment the level is picked.
- Confidentiality, integrity, availability Mark which properties of the asset the risk affects, so the analysis reads the way the standard asks for it.
- Risk value and exposure, computed Impact times probability as the risk value, and the expected loss as exposure, recalculated as you edit and coloured as they cross your thresholds.
- A workflow with guards Identified, in analysis, under treatment or accepted. A risk cannot move on without an owner and a score, and only an approver can accept one.
Step three
Treat it, and score it again
A risk above your acceptance criteria gets treatments: each one owned, dated and tracked to implementation, with the risk scored a second time for what remains.
- Treatment types Decrease, avoid, share or accept, each defined, so the choice of strategy is recorded alongside the action.
- Owned and dated Every treatment has an assignee, a priority and a due date, and follows its own workflow from open through in progress and verification to implemented.
- Residual risk Impact and probability are scored again for the risk as treated. The sheet shows both values side by side and colours each against your acceptance criteria.
- Controls on every treatment Link the controls a treatment puts in place, from the controls library, so the reason for every control is one click away.
Step four
Show the coverage
The links you made while doing the work are the evidence. Which controls you apply, why, and whether what remains is within your criteria, are queries, not a report someone has to write.
- Controls library Structured by the ISO/IEC 27002 control numbers, with room for your own controls beside them.
- Control coverage Every control shown with the treatments that use it and the accepted risks that rely on it, and every control nothing uses yet.
- Requirement coverage The ISO/IEC 27001 clauses, each traced to what fulfils it.
- Risk report Every open risk coloured against the acceptance criteria: within them, brought within them by treatment, or still above them.
None of these are written for the audit. Each one is the register's ordinary state, queried on the day.
The Risk Manager
Work in a sheet. Keep a system.
Risk work is tabular, and people who do it think in rows. The Risk Manager gives them the sheet they expect, on top of items, links and workflows they never have to manage by hand.
Four linked sheets
Asset inventory, asset instances, risk assessment and risk treatment, each showing the items around it: the asset beside its risk, the treatments beside both.
Insert at any level
Add an asset, a risk under it or a treatment under that from the toolbar. The new item is linked and filed in the right document for you.
Spreadsheet speed, system rigour
Edit in cells, undo what you got wrong, then save once. Every change lands as an item with its own history and the workflow rules still apply.
Colour that means something
Risk values coloured as they cross your thresholds, so the sheet reads as a heat map without anyone maintaining one.
What changes
Benefits your organisation will notice
A risk assessment earns its keep in the decisions it supports, not in the spreadsheet handed to the auditor.
One register, not one per assessor
Everyone works in the same live register, on the same scales, so the risk picture is not reassembled from copies every quarter.
Scores you can defend
Defined scales and a library of threats and vulnerabilities make assessments consistent, and the reasoning stays attached to the number.
Treatments that get done
Owners, due dates and a workflow turn the treatment plan into tracked work rather than a column in a spreadsheet.
Decisions with a name on them
Accepting a risk is an approval step, recorded with who and when. Nobody has to reconstruct it before the audit.
Controls with a reason
Each control traces to the risks and treatments that need it, which is the justification an auditor, and your own budget holders, ask for.
Ready for the next review
Re-assessment starts from last time’s register and its history, not from a blank sheet and a meeting invite.
Frameworks
Organised the way the standards are
The method follows ISO/IEC 27001's requirements for assessing and treating information security risk, and the controls library follows the structure of ISO/IEC 27002, so the assessment maps onto the certification you are working towards.
The clause and control libraries carry the standards' numbering. The text of the standards themselves comes from your organisation's own licensed copies.
Better together
The risks here, the way of working in the IMS
Operational Risk Assessment decides which controls you need. The Integrated Management System is where those controls become processes, instructions and trained people. Together they make the Information Security Toolkit: the risk-based argument and the management system that carries it out, in one platform.
Compliance & management
Integrated Management System
Your way of working, where the work happens.
Explore the IMSWhat you buy
A product, and the help to make it yours
Operational Risk Assessment is licensed as a product and delivered with services, because the scales and criteria that make an assessment defensible have to be your organisation's own.
The ORA product
The configured workarea (types, workflows, the Risk Manager sheets, dashboards and libraries) plus access to every update and release while the licence runs.
Content
The threat and vulnerability libraries are included. Your assets, scales and acceptance criteria are set up with you as a service.
Training
Introduction and ongoing training for the people who run the assessment and the people who own risks and treatments.
Support
Product support is part of the licence, for the product and the ROPARC platform beneath it.
A roll-out that starts with your risks, not ours
Platform
Runs on ROPARC
Ready to take your risk register out of the spreadsheet?
We will show you the assessment running on a realistic register, and map what it would take to bring your own assets and risks into it.