Risk decisions with clear ownership.

When a risk is accepted, an exception granted or a tool approved, record who decided, on what evidence and under what conditions, and find it again when an auditor or an incident review asks.

How it fits

Risk and scope

Describe the systems, data and threats in scope, and link the assessments behind them.

Assessment and treatment

Rate likelihood and impact, and compare the treatments: mitigate, transfer, accept or avoid.

Security review

Let security, legal and AI challenge the assumptions and point out gaps in the evidence.

Risk acceptance

The accountable owner approves the treatment, with compensating controls and a review date on record.

Audit trail

Evidence, approvals and every change stay with the decision; lock it once accepted.

Questions

Can we show an auditor what was accepted, and when?

Yes. The decision, its evidence, the approvals and every change stay in its history. Lock it once accepted and its answers are frozen.

Who can see a risk record?

Only the people you invite. Logs are private to you and your invitees unless you choose to publish them.

Does it replace our risk register?

No. Keep the register where it is and link each entry to the decision behind it, with its reasons and approvals.

Do you support single sign-on?

No. Each person signs in with their own prorso account, and the owner of each log decides who is invited and with what access.

How is prorso itself secured?

The Security page describes how prorso is built and operated to protect your data, and the Privacy Policy names who processes it.

Explore example decisions · Read articles

prorso for other teams: Procurement · Software architecture · Product management · Finance & investment · People & HR · Operations & supply chain · Projects & PMO · Strategy & governance