packets.build
Book Demo

00 Risk Assessments

Make every riskvisible, ownedand traceable

Identify, score and treat risks in one structured process, with clear owners, treatment plans linked to controls and a record of every approval.

For AI-native, IT services, fintech and healthtech teams selling to enterprise.

Book Demo
  • 01One risk register with type, categories, owner, treatment strategy and lifecycle state for every risk.
  • 02Candidate risks can be drafted from your scope answers and land in a review queue. People edit, approve or reject each one, and rejections record a reason.
  • 03Formal risk assessments keep before and after scores, review notes and an approval record.

01 Why it matters

Risk management breaks down when the process is informal

  • Registers live in disconnected files

    Risks sit in separate spreadsheets and documents, so teams work from different versions and nothing links to controls or tasks.

  • Scoring is inconsistent

    Different people rate similar risks differently, which makes prioritisation hard to explain and harder to repeat.

  • Treatment has no clear owner

    Actions are agreed in meetings and then lost. Without owners and dates, it is unclear what was done about a risk.

02 What packets is

A structured, traceable way to manage risk

Risk Assessments gives your team a shared process for identifying risks, scoring them on consistent likelihood and impact scales, assigning owners and treatment plans, and recording who approved what. Treatment is linked to controls and tasks, so progress shows up as work gets done. The register becomes a working record rather than a document that is updated once a year.

It is part of the packets AI-powered Governance & Compliance Control Engine, so risks connect to controls, tasks, requirements and AI systems. packets helps with the routine work of drafting and organising. People make the risk decisions.

03 Who it's for

For teams whose risks change as fast as the business

  • AI-native companies

    New models, data sources and features create new risks every release. Keep a living register instead of a yearly snapshot.

  • IT services

    Enterprise clients ask how you identify and treat delivery and data risks. Show a consistent method across engagements.

  • Fintech

    Operational, data and third-party risks need clear owners and documented decisions that can be traced later.

  • Healthtech

    Risks around health data and service availability need documented treatment and approval.

04 How it works

From scope to an approved treatment plan

  1. 01
    People

    Define your scope

    Answer scope questions about your industry, hosting, software and devices. These feed the risk drafting step.

  2. 02
    Agents draft

    Draft candidate risks

    packets drafts candidate risks from your scope answers into a review queue. Nothing enters the register until a person approves it.

  3. 03
    People

    Review and score

    Reviewers edit, approve or reject each draft. Approved risks are scored for inherent likelihood and impact on a five-level scale.

  4. 04
    People

    Assign owners and treatment

    Each risk gets an owner, a treatment strategy (accept, avoid, mitigate or transfer), linked controls and treatment tasks with due dates.

  5. 05
    People

    Assess, approve and monitor

    Run org-wide or department assessments with review notes, then submit for approval. Residual scores and treatment progress stay visible on the monitoring dashboard.

A person does thispackets drafts it, a person approves

Scores use fixed five-level likelihood and impact scales, not a custom model. Risk acceptance is always a human decision.

05 Key capabilities

What your team works with

  • Register

    Risk register
    A single register of identified risks with lifecycle state from draft to monitoring.
    Categorisation
    Classify risks by type, categories, source and affected confidentiality, integrity or availability.
    Drafted risk review queue
    Review, edit, approve or reject drafted risks before they join the register.

  • Evaluation

    Likelihood and impact scoring
    Inherent and residual scores on five-level likelihood and impact scales.
    Monitoring dashboard
    View inherent and residual scores by category, risk type and department.

  • Treatment and tracking

    Risk ownership
    An assignee and risk managers for every risk.
    Treatment plans
    A treatment strategy and plan, with linked controls and tasks that carry due dates.
    Treatment effectiveness
    Weight linked controls and tasks to see how treatment progress affects residual risk.

  • Governance trail

    Formal risk assessments
    Org-wide or department assessments with review notes, before and after score snapshots and a target completion date.
    Approval and rejection record
    A record of who approved or rejected a risk or assessment, and when, with the reason for rejections.

06 Why packets

From a risk list to risks that actually get treated

Many tools

Record risks and send reminders, and leave the follow-through to your team.

Consultants

Run an assessment and provide recommendations, often as a report.

packets

Helps you work through treatment and control closure with an actionable workflow and a Compliance Lead inside your team.

Your Compliance Lead helps with judgement calls. packets supports expert judgement. It does not replace it.

07 Frameworks

Where risk assessment shows up

  • ISO 27001

    Mapped

    Information security risk assessment and treatment, with risks linked to controls and requirements.

  • SOC 2

    Relevant to

    Risk assessment criteria.

  • HIPAA

    Relevant to

    Security risk analysis.

  • GDPR

    Relevant to

    Risk-based approach to personal data protection.

  • ISO 42001

    Planned

    AI risk assessment.

Listing a framework does not mean full coverage, certification readiness or guaranteed compliance.

08 FAQ

Questions about risk assessments

01What does Risk Assessments in packets cover?

A risk register, categorisation, inherent and residual scoring, ownership, treatment plans linked to controls and tasks, a monitoring dashboard, formal assessments and an approval record.

02Which scoring method does packets use?

Risks are scored on fixed five-level likelihood and impact scales, for both inherent and residual risk. Custom scoring criteria are not currently offered.

03What does packets draft for me?

It can draft candidate risks from your scope answers into a review queue. People edit, approve or reject each draft, score the risk and own the treatment.

04Who accepts a risk?

A named person on your team. Risk acceptance is never automatic.

05How does it connect to the rest of packets?

A risk can be linked to controls, tasks, requirements and AI systems in the same control engine, so treatment progress follows the work.

06Does this guarantee compliance or a clean audit?

No. It helps you run a consistent, documented process. Outcomes depend on your controls, your decisions and the auditor.

09 Keep exploring

Turn your risk register into a working process.

Talk to us about how structured risk assessments would work for your team.

Book a demo Talk about your readiness