Product
Risk Register
Risks with owner, likelihood, impact and a mitigation state that only moves along permitted steps.
On this page
What it does
Risk Register keeps a register of risk records for your account. Keeping an organisation's risks with named owners, so that a risk is assessed, treated or accepted by a recorded step. Each risk has a title and the fields below, and its state moves only along the steps listed. The database refuses any other step and any value outside the field rules, and a record in a final state cannot be changed.
The fields
| Field | Holds | Entry |
|---|---|---|
| Category | one of a fixed list; one of operational, security, financial, legal, safety, other | required |
| Likelihood | one of a fixed list; one of rare, unlikely, possible, likely, almost certain | required |
| Impact | one of a fixed list; one of minor, moderate, major, severe | required |
| Owner | one line of text (up to 200 characters) | required |
| Mitigation | text (up to 2,000 characters) | optional |
| Next review | a date | optional |
The states
A new risk starts as identified.
| State | May move to |
|---|---|
| identified | assessed, closed |
| assessed | mitigating, accepted, closed |
| mitigating | accepted, closed |
| accepted | mitigating, closed |
| closed | final state |
Using it
Signed-in accounts open the Risk Register, add records, and move them between states. The change is recorded in the account's audit chain; a state change names the revision it was made against and is refused if the record has moved on. The same operations are available as JSON on the same address.
Data handling
Records belong to the account that created them and are visible to that account only. They are stored in the platform's PostgreSQL database. Do not store special-category personal data in a register unless you have a lawful basis; the privacy notice states what the platform collects and keeps.
Limits
- It is a register for one account; sharing a register between accounts and attaching files are not built.
- The account cannot delete or edit a record, and a record in a final state is kept as it was. The automated erasure step does not remove register records: an erasure request that covers them is completed by the operator.
- There are no reminders or recurring records: dates are stored and shown, nothing is sent when one passes.
- It does not give legal, clinical or regulatory advice; the account holder remains responsible for what the records mean.
Availability
Risk Register is running on RJV's own platform. RJV does not sell a licence for it as a separate product today: the commercial terms state what is on sale. It can be part of the result of an engineering engagement, where the written proposal names it, its licence terms and what you would hold at the end. To discuss it, use Work with Us.
Evidence
The field rules, the permitted steps and the refusal of every other step are enforced by the database and exercised by the platform's own tests. The evidence register lists the graded claims.
Works with
- Audit Chain: Requires. Each record created or moved is entered in the account's audit chain.
- Identity and Access: Requires. An account signs in and holds the grant that lets it use the register.
- AML Programme Build: Works with. Sets up or reviews the records kept here.
- Asset Tracker: Works with. Records in one can be linked to records in the other.
- Board Resolutions: Works with. Records in one can be linked to records in the other.
- Customer Due Diligence Register: Works with. Records in one can be linked to records in the other.
- Executive Advisory: Works with. Used in this industry.
- Financial Services: Works with. Used in this industry.
- Fractional COO Engagement: Works with. Sets up or reviews the records kept here.
- Governance Review: Works with. Sets up or reviews the records kept here.
- Incident Timeline: Works with. Records in one can be linked to records in the other.
- Regulatory Readiness: Works with. Sets up or reviews the records kept here.
- Transaction Alert Review: Works with. Records in one can be linked to records in the other.
Where it runs
| Supported target | A customer-controlled Linux host on x86-64 with PostgreSQL 18 (linux-x86_64-customer-controlled). |
|---|---|
| Not yet supported | Windows, macOS, phones and tablets, and Linux on other architectures. Each needs its own installation, update and recovery evidence before it is supported. |
| Check a device | Run rjv2 preflight on it. It reads the operating system, architecture, memory, disk, listen address, configuration, database, database role and schema, changes nothing, and exits non-zero if release 2.0.0-alpha.1 cannot run there. |
| Installed as | One application and a PostgreSQL database. Installing release 2.0.0-alpha.1 (schema 100) installs every system on this site, including Risk Register. |
| Data | It stays in the PostgreSQL database you run. The only outside service the release can use is an outbound mail relay that you configure. |
| Updating | A release is a numbered build. The schema is applied by a separate owner step (rjv2 migrate), and the application refuses to serve a schema it was not built for. |
| Backup and restore | rjv2 backup writes a checksummed dump. rjv2 restore restores it into an empty database and checks the checksum, the schema version and the audit chain of every account. |
| Leaving | The data is in your own database and can be dumped at any time. What you may do with the release is set by the terms on deployment and ownership. |
- Published
- 29 October 2026
- Revision
- 2