A risk register you can stand behind.
Risks show up everywhere: a pen test, a failed control, a vendor review, an incident, an email from the CFO. TruPilot drafts each one with its sources, a rating, and a dollar range. A person approves it and gives it an owner, and every change after that is on the record.
Loss exceedance
Chance that a year’s losses exceed each amount
Top risks in dollars
Expected annual loss, after and before controls
Residual risk exposure
In dollars, against the risk appetite the board set
TruOps keeps a live risk register. Each risk is rated on likelihood, impact, and velocity, can carry a dollar value, and links back to the evidence behind its score. Risks come in from anywhere: assessments, control monitoring, pen tests, vendor reviews, incidents, and documents. TruPilot drafts each one, and a person approves it and assigns an owner before it enters the register. Every change after that is logged. The same issue found twice becomes one risk, and residual risk updates as fixes land.
The challenge
A risk register should fill itself from the work you already do, so it's current before every meeting.
What you're probably using today
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
| Enterprise GRC suites | They can model almost anything, but that flexibility usually runs through implementation partners and admins, so every change turns into a project. | AI reads your existing documents and sets up the program. Your first assessment opens pre-filled with sources, and you make changes by asking in plain language. |
| Point tools that don't connect | A TPRM portal here, a risk register there, findings in your ticketing tool, and the board pack in slides. Each tells its own story, so leadership gets three different answers. | One place for assessments, evidence, and risk. Upload a document, answer a question, or check a control once, and it counts everywhere it applies. |
From anywhere
A risk can start as an assessment finding, a failed control check, a pen test, a vendor review, an incident postmortem, a threat advisory, or a question in an email. TruPilot sorts each signal: a new risk, part of one you already track, or a finding to fix.
What a control is worth
Say ransomware carries an expected annual loss of $4M. Move immutable backups from Failing to Passing and TruOps recalculates it at $1.1M. That $2.9M difference is the case for the backup project, in the units your CFO already uses. Every control can be weighed this way, so budget goes where it moves the most risk.
A person approves every risk
TruPilot drafts the risk with its sources, a suggested rating, a dollar range, and a suggested owner. It enters the register only when a person approves it, assigns an owner, and sets a treatment. From then on, every change, by a person or suggested by TruPilot, is logged with who made it and why, so the register holds up in an audit.
Risk in dollars
TruOps puts a dollar range on each risk from how often it could happen and what it would cost, informed by your control status and evidence. The register rolls up to expected annual loss and a loss exceedance curve: the chance that a year's losses pass any amount, before and after controls, against the tolerance your board sets.
Show what a control is worth by how far it moves the curve, and give leadership numbers they can weigh against budget. Ratings and heat maps stay available for the teams that use them.
Beyond red, yellow, green
Every risk is rated on three factors out of the box:
- Likelihood: how likely it is to cause harm.
- Impact: how much harm it would cause.
- Velocity: how quickly the harm would hit.
A risk can also carry a dollar figure, like expected loss, so you can quantify risk for leadership. View the same register as ratings, a heat map, or dollars, depending on your audience.
Your method, with AI help
Set your own factors and formula. The agent helps you configure your method and suggests a rating from the evidence for a person to confirm. Every score comes with an explanation, down to the sentence that justified it.
A register that stays current
When two assessments find the same issue, it becomes one risk with both assessments linked. Grouped findings update their risk as items get fixed and close once everything is clear. Duplicates merge automatically, and risks with no owner or past their due date are flagged.
- Inherent and residual risk tracked
- Treatment options: mitigate, accept, transfer, or avoid
- Accepted risks record a reason and an expiry date, and reopen when it passes
- Linked to the controls that reduce them and the vendors or assets they affect
How TruOps helps
- Risks from anywhere
- Findings, failed controls, pen tests, vendor reviews, incidents, and documents become draft risks.
- Every score explained
- Likelihood and impact link back to the evidence behind them.
- Dollar values
- Put a dollar figure on risk when leadership needs more than a color.
- Three views
- See the same register as ratings, a heat map, or expected loss.
- Industry risk library
- Start with risks written for your industry, each with a note on why it applies.
- Approved and owned
- Nothing enters the register until a person approves it and assigns an owner. Every change is logged.
Questions
What is a risk register?
A risk register lists an organization's known risks with their ratings, owners, treatments, and status. See What is a risk register?
Can I use my own risk scoring method?
Yes. Likelihood, impact, and velocity come built in, and you can set your own factors, scales, and formula. The agent helps you set it up.
Can TruOps put a dollar value on risk?
Yes. Each risk can carry a dollar range from its likelihood and impact. The register rolls up to expected annual loss and a loss exceedance curve, before and after controls, against the risk tolerance you set.
What is the difference between inherent and residual risk?
Inherent risk is your exposure before controls. Residual risk is what's left after them. See Inherent vs. residual risk.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Related
A live register with every rating explained, built from what you already know.
→LearnRisk registerWhat a risk register is and what goes in it.
→LearnRisk quantificationExpressing risk in dollars.
→PlatformFindings & remediationEvery finding rated, planned, fixed, and proven closed, with TruPilot helping at each step.
→RolesRisk managerA live risk register you can explain line by line.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.