Skip to content
TrustMosaic

GRC core

MeshRisk

Risk register, assessment and response with the same yardstick for every area, linked to controls and audit.

If your risk management still works like this

  • Risk register untouched since the last review?Risks without owners, duplicated or out of date, and no one trusts the number that goes to the committee.
  • Each area assesses with its own yardstick?Finance's high is not IT's high, and the consolidated matrix turns into opinion.
  • Response plans without follow-up?The deadline passes, the indicator worsens, and it only shows up at the next meeting.
  • Critical supplier off the radar?Third-party risk sits in a procurement spreadsheet, far from the risk register.

What MeshRisk does

  • A living risk register

    Every risk with an owner, area, cause, consequence and linked controls. Risks without owners, duplicated or overdue for review stand out.

  • Single criteria

    Likelihood and impact scales and appetite by category defined once, valid for every area.

  • Inherent and residual

    Residual risk reflects the effectiveness of tested controls, not just the assessor's opinion.

  • Response plans

    Mitigate, transfer, accept or avoid, with an owner, a deadline and follow-up.

  • Assessment history

    Every reassessment versioned with who changed it, the previous level, the new one and the rationale.

  • Committee dashboard

    Matrix, risks above appetite and overdue plans generated from the register, with no manual assembly.

Risk record

Everything about the risk on one record.

Cause, consequence, mitigating controls, related audit findings and the response plan sit together. Whoever opens the risk understands why it is at that level.

History

The level changed, and you know why.

Every reassessment records the previous level, the new one and the decision-maker's rationale. The committee sees the evolution, and audit finds the trail ready.

Illustrative screens with fictitious data.

A methodology regulators recognize

A risk structure aligned with COSO ERM and ISO 31000, with configurable scales, categories and matrix levels.

The AI suggests, the risk manager decides

Mesh Intelligence suggests risks from audit interviews and walkthroughs, seeing only what the person can see. Nothing enters the register without approval, and every accepted suggestion is recorded with its source.

Fits with

  • MeshAuditFrom the annual plan to follow-up: programs, work papers, findings and action plans in one flow, with regulatory profiles such as BACEN and ANS.
  • MeshControlDesign, testing and effectiveness of internal controls, linked to the risks they mitigate.
  • MeshThirdDue diligence and monitoring of suppliers and partners, from onboarding to renewal.

Questions from risk managers

Can I use my own matrix and criteria?

Yes. Likelihood and impact scales, matrix levels and categories are configurable. The default structure follows COSO ERM and ISO 31000, and you adapt it to your organization's risk policy.

How does risk connect to audit?

Risks in the register feed MeshAudit's audit universe and annual plan. Audit prioritizes what carries the most risk, and every engagement shows the risks it covers.

Do areas need training to take part?

No. The owner records the risk in a guided form, with the organization's scales and levels already defined.

What happens when a risk no longer applies?

It is closed with a reason and date, and can be reopened if it applies again. The register shows who created and who last changed each risk.

See MeshRisk with a case from your industry

The demo is led by the founder, who has seven years of internal and external audit experience.

Modules are licensed separately. The platform comes with all of them.