What risk management software should do
Good risk management software lets you record each risk, score it, assign an owner, link it to the controls that reduce it, track the actions that follow, and show the board where the gaps are. It should also stay connected to the rest of your governance work, so that an incident, a complaint or an audit finding updates the picture instead of sitting in a separate system.
What CGRC AI gives you
- A risk register. Each risk has a cause, an event and a consequence, an owner, and three scores: initial, current and target. The register shows when the current score is above target.
- Controls. Link each risk to the controls that manage it, with their status, owner and test dates, and group them under the frameworks and standards you work to.
- Board assurance. For each control, record the sources of assurance across three lines of defence (management, oversight and independent). The system then shows a gap in control or a gap in assurance, in the way a board assurance framework does.
- Actions that are chased and checked. Actions have owners, priorities and due dates, and can be verified by someone other than the owner.
- One connected record. Link risks to incidents, complaints, audit findings and policies, so what actually happens feeds back into the register.
- Review dates and reminders. Risks and controls come up for review on time, and overdue items are flagged.
- Reports for the board. Dashboards, trend charts and Excel exports, with access controlled by role and by team or location.
How the gaps are worked out
The system looks at each risk and its controls and tells you plainly where attention is needed. A control has a gap if it is not fully in place or its latest assurance was negative. It has a gap in assurance if there is no recent evidence, no independent evidence, or finished actions that nobody has verified. A risk has a gap if it has no controls, if a linked control has a gap, or if its current score is above its target. The results are worked out live from your own records and are never stored as a separate list that can go stale.
AI that helps and people who decide
Staff can describe a risk in plain words and the AI drafts the entry for them to check. When someone reviews a risk, the AI can read your own policies and your earlier similar closed cases and say which ones it used. It drafts and suggests. People decide. It is not trained on a customer's data and never sees another customer's. See what the AI does at each step.
Who it is for
It suits any organisation that has to show it controls its risks, including hospitals and care providers, charities and research organisations. CGRC AI records and tracks. It does not certify that your risks are controlled, and it holds no formal certifications yet.
Common questions
What is risk management software?
Risk management software is a system for recording risks, scoring them, linking them to controls and actions, and showing leaders where the gaps are, in place of spreadsheets and separate documents.
What is a board assurance framework?
A board assurance framework is a way of showing a board the main risks to its objectives, the controls in place, and the evidence that those controls work. CGRC AI supports this by recording assurance against each control and showing the gaps.
Can it replace our risk register spreadsheet?
Yes. You can set up your risks in the system, and there is an import tool for bringing in an existing register from a spreadsheet.
Does it work for risks other than clinical ones?
Yes. Risks can be classed by type, such as strategic, operational, financial, compliance or reputational, as well as by clinical domain.
Related pages
Interested in being a pilot partner? Get in touch and we will arrange a conversation.
Last updated 12 October 2026.