Risk register

Risk register in Keel

A risk register is the running list of what could go wrong, how bad it would be, and what you are doing about it. In Keel the register is not a standalone spreadsheet: each risk connects to the controls that reduce it, so your risk picture and your control work stay in step.

Add a risk

In Risks, create a risk with a short title, a description, and a category (for example third party, operations, people, or availability). Give it an owner so there is always someone accountable for the decision, not just the entry.

Start from the scenario library

The Scenario library tab on Risks lists common information security risks, grouped by category. Each one carries a suggested inherent likelihood and impact and the ISO 27001 Annex A control areas that typically treat it. Owners and admins press Add to register on the ones that apply, then adjust the scores and link controls on the risk itself.

The suggested scores are typical values before any control is applied. They are a starting point for your own assessment, not a replacement for it.

Tailor with AI rewrites one scenario for your workspace, using your industry, company size and primary framework, and suggests its own likelihood and impact with a one-line reason. The draft opens under the scenario with every field editable. Add tailored risk adds it as you left it; Discard drops it. The library scenario itself never changes. A scenario whose title is already in your register shows In register. Tailoring uses AI credits, and a failed run is refunded.

Import a register you already have

To move an existing register into Keel, open Import CSV on Risks and start from the template. Only title is required. Likelihood and impact are 1 to 5 and come in pairs, and a risk with both blank arrives unscored. An owner_email must belong to someone on your team; use owner for a typed name instead. One bad row imports nothing, and imported owners get no email.

Rate inherent and residual risk

Keel captures two scores for every risk:

Inherent risk: how severe the risk is before your controls, based on likelihood and impact.
Residual risk: how severe it remains after the controls you have in place.

The gap between the two is the value your controls are actually adding. When you strengthen or add a control that a risk depends on, Keel suggests a lower residual score for you to apply.

A score is likelihood × impact, each rated 1 to 5. A score of 15 or more is High, 8 or more is Medium, and anything lower is Low.

A risk imported from another GRC platform can arrive with no likelihood or impact, because the source never scored it. Keel does not fill in a score for you. The register marks the risk Needs scoring until someone rates it.

On a risk’s Assessment tab, Suggest score asks AI for an inherent likelihood and impact based on the risk’s description, with its reasons. The suggestion appears above the form. Choose Apply to write it to the risk, or Dismiss. It uses AI credits, and a failed run is refunded.

Draft risks with AI

Draft risks with AI writes a handful of risks from your framework and company context. Add an optional focus to sharpen them. Each draft lands in the register as an open risk you can edit or remove. It uses AI credits.

Find duplicate risks

Find duplicates compares every risk in the register and groups the ones that describe the same exposure, with a one-line reason for each group. In each group, pick the risk to keep and choose Merge: the controls linked to the other risks move onto the one you kept, and the others are closed rather than deleted. Each closed risk gets a line in its description naming the risk it was merged into and the date, so the register keeps a record and you can reopen one by changing its status. Choose Not duplicates to drop a group. It uses AI credits, and a failed run is refunded.

Work on several risks at once

Tick risks in the register to open the bulk bar. Set status, Set treatment and Set owner change every ticked risk. Owners and admins can also delete the selection. A bulk owner change sends no email. Selection covers the page you are on. Suggest controls runs the control suggestion below for the ticked risks, and the confirm step says how many one run covers. Each risk is charged on its own and refunded on its own if it fails. Nothing is linked. A risk with suggestions waiting shows a suggested marker in the register that opens its Controls tab.

The risk page

A risk’s page has three tabs. Assessment holds the scores, owner, treatment and status. Controls lists the linked controls and the control suggestions. Evidence attaches and lists the evidence on those controls. Each tab has its own address, so you can link straight to one.

Connect risks to controls

Link each risk to the controls that treat it. Because controls are crosswalked across frameworks, the same control work that lowers a risk also moves your framework coverage forward. This is the practical benefit of one connected graph: reduce a risk once and the effect shows up everywhere that control applies.

Suggest controls with AI

On a risk’s Controls tab, Suggest controls reads the risk’s title, category and description against the controls in your workspace and lists the ones that would treat it. Each suggestion shows a confidence and a one-line reason. Choose Link on the ones you accept, or Link all. Nothing is linked until you do, because a linked control feeds the residual suggestion. Keel only suggests controls that exist in your workspace and skips the ones already linked. It uses AI credits, and a failed run is refunded.

Attach evidence from a risk

On a risk’s Evidence tab, Attach evidence uploads a file and links it to every control linked to that risk. Keel stores evidence against controls, so a risk with no linked controls asks you to link one first. The file type, size and storage limits are the same as on Evidence > Upload, and the auditor role cannot upload. The page also lists the evidence already on the risk’s controls, each linking to its record.

An uploaded file has no environment label, so it is not linked to an access-review control that requires one. The page then shows a warning that names only the controls the file was linked to. To link it to the skipped control, label the file on its evidence page and link it from there.

Find coverage gaps

The SoA coverage tab on Risks shows where your risk register and your Statement of Applicability disagree. Risks needing control coverage are listed worst first: risks with no control linked, then risks whose linked controls are not yet implemented, then risks with only some implemented. A risk with no mitigating control is accepted by default rather than by decision, and an auditor looks for that gap first.

When the workspace has an SoA, the tab also lists in-scope controls that no Keel control is mapped to. Link a control on the SoA, or justify the exclusion there.

It also lists in-scope controls with no risk behind them: the SoA maps them to Keel controls, but no open risk links to any of those controls. Link the risk each one treats, or record it on the SoA as a baseline control.

Missing justifications counts the in-scope controls whose SoA justification is blank. Owners and admins can choose Draft justifications: AI writes a sentence or two for each, naming the risks it treats, or calling it a baseline control when no risk does. It does not invent legal or contractual reasons. Edit any draft, untick the ones you do not want, and choose Save ticked to the SoA. A control that gained a justification after the drafts were made is left alone, and an excluded control’s reason is still edited on the SoA. It uses AI credits, and a failed run is refunded.

Treat and track

Decide how to handle each risk, treat it (implement or improve controls), accept it (record the decision and who made it), transfer it, or avoid it. Turn treatment work into tasks so it has an owner and a due date, and review the register on a cadence so nothing quietly drifts.

Draft a treatment plan with AI

On a risk’s Assessment tab, Draft treatment plan asks AI for three to six tasks that carry out the risk’s chosen treatment, using the controls already linked to it. Untick any you don’t want and choose Create ticked tasks. Each task is linked to the risk and appears in Tasks. Nothing is created until you choose. It uses AI credits.

Next steps

Evidence: prove the controls that treat your risks are operating.
Tasks: turn risk treatment into owned, dated work.
Frameworks & crosswalks: how one control reduces risk across many standards.