A risk register that's current the moment you open it.
A risk register reviewed on a calendar is stale by design — it describes the organization as of the last workshop. The risks that hurt are the ones that arrived since: the AI system a business team deployed in March, the supplier onboarded quietly, the regulation that entered into force.
TruSecure keeps the register live and interlinked: every risk linked to its controls, owners and evidence; every change a trigger. The committee reviews what changed since it last met — and nothing waits a quarter to be assessed.
What changes for the committee
- Every risk linked
Risks connect to controls, owners, evidence and exceptions. No orphan lines that no one can explain.
- Triggers, not calendars
A changed control state, a new supplier, a new AI system, a new regulation — each fires assessment, re-scoring where warranted.
- Intake for what's new
Emerging risks enter a structured queue with a named owner and a clock, not a parking lot.
- Minutes on the record
Acceptances, escalations and decisions are captured with the named decision-maker — the committee's trail is its minutes.
What you'd actually look at
One register entry as it reaches the committee — opened from the dashboard's committee view:
- Owner
- named owner on record
- Linked controls
- TPRM-1 · TPRM-2
- Appetite
- within · 1 exception
- Trigger
- supplier assessment changed
- Review
- escalated to committee
- Next review
- on change · not calendar
What the committee is accountable for overseeing
| What it asks of the committee | Citation | Where it is answered |
|---|---|---|
| NIS2 · management-body oversight of the measures | Art. 20 | Register · minutes |
| NIS2 · risk-analysis policies and procedures | Art. 21(2)(a) | Risk register |
| DORA · ICT risk framework and risk tolerance | Art. 5 · 6 | Register · exceptions |
| ISO 27001 · risk assessment and treatment | Clause 6.1 | Linked controls |
Appetite with something behind it
Risk appetite usually lives in a policy statement; here it is a property of the register. Each risk is scored against stated appetite, exceptions carry owners and expiry dates, and the committee view shows both together — so "within appetite" is a query result, not an assertion. The committee governs by exception, and sees every exception open, who owns it, and when it expires.
How committees usually start
A committee briefing built from sample data, then onboarding stands up the linked register for your first regime, and the subscription. No self-serve checkout, no per-seat math.
TruSecure helps operationalize requirements and prepare evidence. Legal interpretation should be validated by qualified counsel.