GovernanceRisk Management

Risk Management

A risk register that connects to your program, AI maps each risk to the controls that mitigate it and drafts the treatment tasks to close it.

Most risk registers are a spreadsheet that lives beside the compliance program and never touches it. Aegis makes the register part of the program: every risk is tied to the controls that reduce it and the tasks that treat it.

The register

When your program is materialized, Aegis seeds a starter risk register relevant to your business. Each risk carries:

  • Inherent risk — probability and impact before controls, plotted on a heat map.
  • Residual risk — the exposure that remains after your controls are accounted for.
  • A category and department, so risk is sliceable by area of the business.
  • A treatment strategy — mitigate, accept, transfer or avoid.
  • An owner accountable for it.

The heat map and dashboards give you the portfolio view a CISO needs: where the concentrations are, what is trending, and what still sits above your appetite.

Risks do not only come from the seeded register. A finding from a penetration test can be promoted straight into the register in one click, arriving pre-scored and carrying its CVSS, CWE and remediation, so a real vulnerability becomes a tracked, owned risk instead of a line in a PDF. Critical and high findings from NexusVoid Argus can be promoted the same way, with Add to risks on the Code Security page.

AI-mapped controls and treatments

This is where Aegis does the work a consultant usually bills for. For each risk, Aegis:

  1. Maps it to the controls that genuinely mitigate it, chosen from your own control library, not a generic list, and only controls that actually apply.
  2. Generates concrete treatment tasks, the specific actions that move the risk down, assigned into your normal task backlog.

The effect is that opening a risk shows you not just a score but the controls reducing it and the work left to do. The register and the program stay in sync because they are the same system.

Linked tasks

The treatment tasks Aegis drafts are linked to their risk. Open a risk's Tasks tab and the Linked tasks section lists the compliance tasks that treat it, each with its assignee, frequency and status (To do, In progress, Done, Not relevant or Failed). Open a task to add its evidence. When a risk has no linked tasks, the section does not appear.

Tasks are linked when Aegis maps your risks, and through the API (riskIds when creating a task). Linking or unlinking a task by hand in the app is not available yet.

Aegis only maps a risk to controls that exist in your library, and it does not invent evidence. Suggested mappings and treatments are a strong first draft for a human owner to confirm, not an automatic sign-off.

Working risk day to day

Confirm the register

Review the seeded risks, adjust scoring to your reality, and add anything specific to your business.

Let Aegis map and draft

Have Aegis map risks to mitigating controls and generate treatment tasks.

Treat and track

Work the treatment tasks like any other backlog item; residual risk reflects your progress.

Review on a cadence

Revisit the register regularly, risk management is a control in its own right, and Aegis keeps the activity trail.

Why it satisfies auditors

Risk assessment is a requirement in essentially every framework Aegis supports, SOC 2, ISO 27001, NIST, the EU AI Act. Because the register is scored, owned, mapped to controls, treated with tracked tasks and reviewed on a cadence, it produces exactly the evidence those requirements ask for, as a by-product of running it.

Next steps

Controls

The controls your risks map to.

Vendor Management

Third-party risk, assessed the same way.

Penetration Testing

Promote pen-test findings into the register.

Evidence & Tasks

Where treatment tasks live.

Use Cases

Risk in a real program.

Contact us

Was this page helpful?