Axiom Risk

Established through the Context section of the interface. The Objectives page formalises the organisational context by requiring that objectives are registered, described, assigned to an organisational level, and owned before risk identification begins. The Criteria tables (CER scale, CRC taxonomy, Treatment Types, Risk Matrix, Organisational Levels) define the measurement and classification framework that will be applied consistently across the register. The ongoing monitoring of the external context required by clause 6.3 is operationalised through the Risk Horizon, described in Section 4.7: a continuously running intelligence layer that scans the external environment, governs detected signals, and provides the traceable pathway through which emerging external risks enter the register.

Supported through the Risks and Contributing Factors pages. Each risk is defined as the negative effect of uncertainty on a specific objective. Contributing Factors capture the causal pathways through which the risk can materialise, providing the granular layer that connects the risk to its controls. This two-layer structure (risk and contributing factor) produces a richer and more actionable identification record than a flat risk description alone.

The calculation chain described in the white paper. The analysis is not assessors’ judgment applied after the fact; it is the mathematical output of the CES values flowing from completed control assessments through contributing factors to the risk and objective level. The analysis is continuous, automatic, and fully traceable.

Supported through the Risk Criteria table, which maps every RRS value from 1 to 25 to a risk category (Low, Medium, Significant, or High) and a corresponding %RE value. The risk category is updated automatically when the RRS changes. No manual categorisation is required. The Risks Dashboard and Objectives Dashboard present the evaluated risk position at summary and detail level for governance review.

Managed through the Actions and Treatment Decisions pages. Mitigating actions (linked to controls or contributing factors) represent the decision to invest in control improvement. Formal treatment decisions (Accept, Transfer, Avoid, Escalate) are recorded as separate records linked to the risk, with the treatment type drawn from the Criteria: Treatment Types table. The two surfaces are deliberately separated: improvement actions drive %AC upward through the calculation chain; formal treatment decisions are governance positions that sit outside the calculation.

Continuous by design. Because residual risk recalculates automatically from the most recent completed assessment for each control, the register reflects the current state of the control environment at all times. The Last Assessed field on each control record makes it immediately visible when a control has not been assessed within an expected period, prompting review without requiring a scheduled audit cycle.

Delivered through the Reporting section of the interface: the Objectives Dashboard, Risks Dashboard, and Controls Dashboard. These three views provide the board and governance layer with a current, objective, and auditable summary of the organisation’s risk position. Every number on every dashboard is derived from the same unbroken calculation chain. There are no manually entered summary figures.