Enterprise Risk Management That Your Divisions Will Actually Update
One register for your strategic, operational, financial, reputational, legal and environmental risks, with third-party risk management built in. Each risk is tied to the objective it threatens, scored on your own matrix and followed through to a decision.
ERM-031Key supplier failure disrupts serviceHighERM-027Regulatory change not trackedMediumERM-019Loss of critical staff knowledgeMediumERM-012Budget overrun on core programmeLowEverything Enterprise Risk Needs, on One Core
Score on Your Matrix
Inherent risk from probability and impact, residual risk after controls. Both matrices match your risk policy, and changes never rewrite history.
Every Risk Ends in a Decision
Treat, tolerate, terminate or transfer. Tolerating a risk opens a risk acceptance form signed by the risk owner.
Key Risk Indicators
Green, amber and red thresholds, higher or lower is worse. Arbor tracks the trend and alerts the owner when a value turns red.
Incidents and Issues
Anyone can report an incident from their task screen. Issues get an owner, a due date and a corrective action.
Third-Party Risk Management (TPRM)
Tier your suppliers, send due diligence questionnaires through a secure one-time link and score the answers. High-risk suppliers prompt a new entry in the risk register.
Start from What You Have
Import your current register from the Excel template. Arbor checks every row before it loads.
Your Suppliers Are Part of Your Risk. Manage Them That Way.
TPRM is built into Enterprise Risk at no extra cost. Every supplier is tiered, assessed and reviewed in the same platform as the rest of your risk.
- Supplier inventory with services, data handled, contract dates and owners
- Risk tiers that set how deep and how often each supplier is assessed
- Due diligence questionnaires answered through a secure one-time link
- Automatic scoring, with high-risk answers flagged for review
- Supplier risks in the same register, matrix and dashboards as every other risk
- Requirements mapped to ISO 27001, SOC 2, SAMA CSF and NIST 800-53
SUP-014Cloud payroll providerTier 1SUP-009Data centre hostingTier 1SUP-017Marketing agencyTier 2SUP-021Facilities cleaningTier 3Onboard and Tier
Add the supplier, record the service and the data it touches, and Arbor suggests a risk tier.
Assess Through a Secure Link
The supplier answers a due diligence questionnaire through a one-time link. No login, no spreadsheets by email.
Score and Treat
Answers are scored automatically. High-risk suppliers raise an entry in the risk register with an owner.
Review and Renew
Reviews come round on a schedule set by tier, with reminders, contract dates and offboarding tracked.
From Set-Up to Proof in Four Steps
Identify
Record the risk, its category, owner and the objective it threatens.
Score
Rate inherent risk, apply your controls and see the residual risk.
Decide
Treat, tolerate, terminate or transfer, with sign-off from the risk owner.
Monitor
Track key risk indicators, incidents and actions until the risk is closed.
Enterprise Risk as Your Team Sees It
Every screen is role-based. Focal points see their tasks, managers see the whole picture.
| Ref | Item | Owner | Status |
|---|---|---|---|
ERM-031 | Key supplier failure disrupts service | Owner 1 | High |
ERM-027 | Regulatory change not tracked | Owner 2 | Medium |
ERM-019 | Loss of critical staff knowledge | Owner 3 | Medium |
ERM-012 | Budget overrun on core programme | Owner 4 | Low |
One Piece of Work, Credited Everywhere
Enterprise Risk runs on the frameworks marked Included. Its records are also mapped to the related standards marked Mapped, so one piece of work counts toward your integrated management system.
Describe It Once. Arbor AI Fills in the Rest.
Arbor AI drafts records, suggests controls and evidence, and maps them to your frameworks. You review and approve every suggestion.
Try Arbor AI for Enterprise RiskShaped Around How You Work
Your fields, your workflows, your risk matrix and your organisation structure.
Frequently Asked Questions
Can We Use Our Own Risk Matrix?
Yes. Scales, scoring and colours follow your risk policy, and changes never rewrite past scores.
Is Third-Party Risk Management an Extra Cost?
No. TPRM is included with Enterprise Risk.
How Do Suppliers Answer Questionnaires?
Through a secure one-time link. They do not need an Arbor account, and nothing is sent as a spreadsheet attachment.
Can Supplier Reviews Follow Our Tiers?
Yes. Each tier sets how deep the questionnaire goes and how often the supplier is reviewed.
Can We Load Our Current Register?
Yes. Import it from the Excel template on day one.
Works Even Better Together
ISMSInformation Security
Run ISO 27001, ISO 27017 and UAE IA from one set of controls.
BCMSBusiness Continuity
Profile your departments, run the business impact analysis, build recovery plans and test them.
OHSMSHealth and Safety
ISO 45001 helps organisations of any size prevent work-related injury and ill health.
See Arbor GRC with Your Own Frameworks
Bring your current risk register. We can import it from Excel during the demo, so you see your own risks in Arbor, not ours.