Counted
How many car accidents happen in London on a rainy Thursday morning?
One figure
Insurers have decades of data and can give a precise figure.
Risk management
Risk Management Software
Score every risk on a matrix you configure and link what treats it. eramba tracks every review.
- Your matrix, your rules
- Asset, third party and business risks
- Flat annual fee
- Community edition free
Two estimatesA wide range
A risk score is an estimate
Some things can be counted, most risks can only be judged. That is fine, as long as the model stays simple enough to discuss.
Judged
How likely is your website to be hacked this year?
Somewhere below 20%
An honest answer is a range. Multiply two ranges and the result is wider still.
Configure the model you want
eramba does not fix the method. These settings decide it, and the classifications are shared by asset, third party and business risks.
- One matrix or severalOne Likelihood and one Impact, or one Likelihood against several Impact types.
- Classification typesThe axes, named the way your organisation talks about risk.
- ClassificationsThe values on each axis: Low to High, 1 to 5, or your own scale.
- CalculationAddition or multiplication for a single matrix, multiplication for several.
- Risk appetiteA title, a description and a colour for every cell.
- Treatment optionsFor Accept, Avoid, Transfer and Mitigate, which solutions are mandatory.
HighMediumLowLowMediumHigh
A simple place to start: three by three
One matrix, three values per axis, and each cell says how high the decision has to go.
| Likelihood low | Likelihood medium | Likelihood high | |
|---|---|---|---|
| Impact high | Risk owner signs off | Requires manager sign-off | Requires director sign-off |
| Impact medium | Risk owner signs off | Requires manager sign-off | Requires manager sign-off |
| Impact low | Risk owner signs off | Risk owner signs off | Risk owner signs off |
A risk is only useful once something is attached to it
Link a risk to what treats it, and the treatment has an owner and a date of its own.
Something you do
Endpoint encryption, account provisioning, log reviews. Tested at intervals.
Something you wrote
Written, approved and reviewed on a schedule.
A decision to accept it
Documented, owned, and valid until the date you set.
Something you will do
Tasks, owners and deadlines, linked back to the risk.
Every risk carries its own review date
Each risk has an owner, a classification, a treatment and the date it is next reviewed. eramba keeps both the inherent and the residual score.
A control that fails its audit flags every risk that relies on it, so a weak treatment shows up on the risks as well.
Where the method gets used
Framework page
ISO/IEC 27001:2022
Clause 6 planning: how the standard reads risk assessment and treatment.
See the pageFramework pageISO 27002, Annex A
Annex A exists to treat risks. These are the 93 controls.
See the pageFramework pageDORA
Pillar one is an ICT risk framework owned by the board.
See the pageUse caseCompliance management
The six steps that apply to every framework you import.
See the pageDocumentation
The free Risk Management course walks through the setup. Each link opens at its heading.
Free course · 36 minRisk Management courseAsset, third party and business risks in eramba: classifications, the matrix, treatment and reviews.
- Risk ClassificationsOne matrix or several, and the values on each axis.
- CalculationAddition or multiplication, and when to use which.
- MatrixA title, description and colour for every cell.
- Treatment OptionsMandatory and optional solutions per option.
- Identification Risks & TreatmentOne method for finding risks that works for most organisations.
- Risk ReviewsScheduled, ad-hoc and changed reviews.
Build your matrix, not ours
Classifications, calculation and matrix cells are all settings. Start with the free Community edition, with no user limit.
- 39,707 downloads last year
- 639 enterprise users
- 11 releases last year
- Used for ISO, PCI and SOC 2 since 2015
Pricing
Flat annual price. Unlimited users, unlimited data, every module included. Your bill does not grow with your team.
Community
Free
Self-hosted. No user limit, no time limit.
DownloadCommunity SaaS
Coming soon
The same Community, run by us. Focus on GRC, not on servers.
See editionsEnterprise on-premises
from 2500€/year
Runs on your infrastructure, with support and updates.
See pricingEnterprise SaaS
from 5000€/year
Hosted and operated by eramba, in the EU or the US.
See pricingNeed more detail?
Tell us how you manage risk today and we will send you something useful. No sales sequence.