Most risk register templates give you column headings and leave the hard part to you. This one arrives with 46 pre-written risk scenarios drawn from live engagements across cyber, privacy, AI, cloud, third-party and resilience domains, each phrased as an event with a cause and a consequence.
The quantification model is built in. Rather than a five-by-five heat map, each scenario carries frequency and magnitude ranges that compute an annualised loss exposure, so treatment options can be compared on risk reduction per rupee.
The treatment sheet tracks owner, budget, target date and residual exposure, and the summary view produces the three charts a board actually asks for: exposure by category, trend against appetite, and treatment velocity.
Why it is structured the way it is, and the failure patterns it was designed around.
Most SOC 2 reports are filed unread, which makes them a compliance ritual rather than assurance. Five checks any procurement or risk reviewer can run, and what each one catches.
Tiering model plus four proportionate question sets, so a low-risk vendor answers eight questions and a critical one gets genuine scrutiny.
Most organisations discover their first real gap during an audit or an incident. The assessment surfaces it in fifteen minutes instead — scored, benchmarked and prioritised, with nothing to buy.
Built for
Kept current
Version 3.2, revised 18 May 2026. We update when a framework changes, when new rules are notified, or when an engagement teaches us something that improves it.
XLSX + PDF guide · 28 pages
What this will not do
A template cannot know your systems, test your controls or make the judgement calls that determine whether a programme holds up in an audit. Use it to move faster, not to skip the thinking — and treat any resource claiming to make you compliant on its own as a warning about its author.
Boards do not fund amber. Calibrated estimation produces defensible loss-exposure ranges from expert judgement — here is the method and its failure modes.
Uniform assessment means no vendor gets real scrutiny. Tier by what the vendor can actually reach, then vary depth — including the questions AI vendors need that nobody asks.
A DPDPA-conformant notice set — customer, employee, vendor and website — with itemised processing tables and multilingual structure built in.
The technical specification for consent that actually propagates — data model, event schema, versioning rules and downstream enforcement patterns.
Your position across privacy, security, governance, risk and AI accountability, scored against sector benchmarks rather than a generic scale.
The specific gaps that matter most for your sector and size, ordered by risk reduction rather than by framework clause number.
Where you stand against DPDPA, ISO 27001, ISO 42001 and SOC 2 — and which of them your buyers are most likely to ask for next.
No sales call required to see your results. Take it, read the output, and decide independently whether you want to talk to anyone.
