Risks, Controls, Issues, and Incidents in one workbook that calculate each other. Incidents drive likelihood. Controls drive residual risk. Open findings degrade the controls they hit — automatically.
Most programs keep risks, controls, issues, and incidents in four disconnected spreadsheets. This workbook connects them: each entity feeds the others, so your risk ratings are conclusions drawn from evidence — not opinions waiting to be challenged.
Every number is a formula over your inputs — not a workshop opinion. Change an input and the ratings move. That's what makes the output defensible.
Inherent → controls → residual. Likelihood suggested from incidents; residual calculated from control effectiveness — with override.
A control library typed P/D/C, mapped to SOC 2 / ISO / NIST CSF / DORA / FFIEC, with effectiveness that open issues degrade.
Findings sourced from Internal Audit, Regulatory Exam, Certification — linked to the control they affect.
Events linked to risks. The count drives suggested likelihood; the worst impact raises the inherent floor.
The junction linking risks to the controls mitigating them — the spine of the residual calculation.
Auto-populated: KPI cards, residual heat map, top risks, coverage gaps. Zero manual entry — board-ready.
Every rating is a transparent formula over your inputs, so it holds up when someone asks "why is this rated this way?"
Ratings trace back to the inputs that produced them — the audit story is built in, not reconstructed after the fact.
Controls carry SOC 2, ISO 27001, NIST CSF, DORA, and FFIEC citations — so the register doubles as evidence for the frameworks you're assessed against.
The thinking behind the model: The Connected GRC Model and How to Build a Risk Register That Calculates Residual Risk.
A single Microsoft Excel workbook (.xlsx). It recalculates on open — no macros, no add-ins, no subscription. Also opens in Google Sheets and LibreOffice.
No. You fill the shaded input cells; the white cells calculate. Dropdowns prevent bad entries, the Start Here tab walks you through it, and it ships with worked examples you delete before use.
Yes — internally or in client engagements. You can't resell the template itself as a template.
If you need it adapted to a specific framework, org size, or regulator, get in touch — customization and advisory are available.
One workbook. Risks, controls, issues, and incidents that finally talk to each other.