Assess every enterprise risk the same way: likelihood and impact on a 5×5 matrix, a residual score that responds to how your controls actually test, and, when a number matters more than a colour, Monte Carlo loss quantification.
Risk assessment in Rukn ERM starts with two judgements every assessor already makes: how likely the risk is, and how severe its impact would be, each on a scale of 1 to 5. Their product is the inherent score, from 1 to 25, and the score decides the risk level:
| Level | Score |
|---|---|
| Low | 1–4 |
| Medium | 5–9 |
| High | 10–16 |
| Critical | 17–25 |
Because the level is calculated rather than typed, a High in finance means the same as a High in operations, and every assessment lands on the same heat map.
An assessment that stops at likelihood × impact ignores the controls you already pay for. Rukn ERM keeps the three numbers apart, so you can see both the exposure and what your controls are doing about it.
The exposure before controls: likelihood × impact. It answers "how bad could this be if nothing stood in the way?"
A rating from 1 to 5 of how well the controls in place work. When a risk has linked controls with ratings, it is their average, so it follows the latest test results rather than an old opinion.
The exposure that remains: the inherent score reduced by 15% per effectiveness point, up to 75%. A risk scored 20 with controls rated 4 has a residual score of 8.
The reasoning, with three worked examples, is in inherent vs residual risk.
Residual risk is only as credible as the control ratings behind it. Each control in Rukn ERM has an owner and a type (preventive, detective, corrective or directive), and can be linked to every risk it mitigates.
A heat map shows which risks are red. Monte Carlo simulation estimates what they could cost. Add an annual probability and a minimum, most likely and maximum loss to any risk, and Rukn ERM simulates your aggregate annual loss.
Monte Carlo simulation is included on the Growth and Enterprise plans.
Assessments live on the risks in your risk register, and between assessments, key risk indicators show whether a risk is moving. Rukn ERM is aligned with the COSO Enterprise Risk Management framework (2017), where assessing, prioritizing and responding to risk form the Performance component.
Inherent risk is the exposure before any controls: likelihood × impact. Residual risk is what remains once the controls in place are taken into account. The gap between the two shows how much your controls are doing. Read the worked examples.
Control effectiveness is rated from 1 to 5, and each point reduces the inherent score by 15%, up to 75%. When a risk has linked controls with ratings, its effectiveness is the average of those ratings, so re-testing a control updates the residual score of every risk it covers.
No. Rukn ERM is built for enterprise risk assessment: strategic, operational, financial, compliance and technology risks assessed against the organization's objectives and appetite. It is not a site-inspection checklist or a vulnerability scanner, although those risks can be recorded and assessed in the register like any other.
Qualitative 5×5 assessment, controls and residual scoring are on every plan, including the trial. Monte Carlo loss quantification is included on the Growth and Enterprise plans. Compare plans.
Start a 30-day free trial for up to 3 users. No card required.
Rukn ERM