MPG Governance Module

Governance Risk Management Software

From risk identification to treatment, monitoring, and reporting — manage your entire risk lifecycle in one connected governance workspace.

What It Is

The Risk Management module is MPG's comprehensive risk engine. It provides a structured risk register, risk assessment workflows, control management, risk treatment plans, incident tracking, and continuous monitoring — all connected to your governance obligations, policies, and third-party relationships.

Rather than treating risk as a standalone exercise, MPG connects every risk to the controls that mitigate it, the policies that govern it, the obligations that require it, and the third parties that introduce it. This creates a living risk picture that updates as your governance environment changes.

The module supports both enterprise risk management and operational risk, with configurable risk taxonomies, assessment templates, scoring methodologies, and appetite frameworks. Whether you are running an annual risk review cycle or responding to an emerging risk signal, MPG gives you the tools to act quickly and document thoroughly.

Who It Is For

Chief risk officers and risk committees
Risk managers running risk assessments and reviews
Compliance officers managing regulatory risk
Internal audit teams testing control effectiveness
Operations managers identifying and mitigating operational risk
Board members with risk oversight responsibilities

Problems It Solves

✕Risk registers maintained in spreadsheets with no connection to controls or obligations
✕Inconsistent risk assessment methodologies across the organization
✕No link between risk appetite, actual risk levels, and treatment decisions
✕Control testing disconnected from the risks they mitigate
✕No early warning system for emerging or deteriorating risks
✕Incident response disconnected from root cause and remediation
✕Risk reporting that is manual, infrequent, and out of date

How MPG Solves Them

MPG provides a structured risk register where every risk is assessed for inherent and residual likelihood and impact, assigned an owner, linked to controls, and tracked through its treatment lifecycle. Risk assessment templates ensure consistency, while configurable scoring lets you adapt the methodology to your organization.

Risk appetite frameworks define tolerance thresholds, and the system flags when residual risk exceeds appetite — triggering treatment plans, escalations, and board reporting. Controls are linked to the risks they mitigate, with test results feeding directly into residual risk calculations.

Emerging risk signals and risk incidents are captured and routed through investigation, root cause analysis, and remediation workflows. Continuous monitoring through KPIs, assessments, and review cycles ensures your risk picture is always current.

Key Features

Centralized risk register with inherent and residual risk scoring
Configurable risk assessment templates and methodologies
Risk appetite framework with tolerance thresholds and breach alerts
Control library linked to risks with test results and effectiveness ratings
Risk treatment plans with actions, owners, and deadlines
Risk incident tracking with root cause analysis and remediation
Emerging risk identification and signal monitoring
Risk review cycles with automated scheduling and distribution
Risk heatmap and dashboard visualizations
Risk reporting for boards, regulators, and stakeholders
Integration with compliance obligations, policies, and third-party risk
Full audit trail for every risk decision and treatment action

Reporting Studio & Governance AI

Every record in this module can be reported on

The Reporting Studio turns what your workspace records into governed figures — compiled from your own records, approved before anything leaves the workspace, and answered with citations.

Governed measures

Each figure is compiled from the module's own records and carries the instant it was read at and what it leaves out.

Approval before release

A report pack leaves the workspace only once the approval chain its report type requires has decided on it.

Answers you can check

The assistant points to the records each answer rests on, and it never approves, publishes, releases or deletes anything.

See how Reporting Studio works

Workflow

1

Identify risks through assessments, signals, or manual entry

2

Assess inherent likelihood and impact using configurable templates

3

Identify and link controls that mitigate the risk

4

Assess residual risk considering control effectiveness

5

Compare residual risk against appetite thresholds

6

Define treatment plans for risks above appetite

7

Monitor through review cycles, KPIs, and continuous monitoring

8

Report to risk committee, board, and regulators

Use Cases

Annual enterprise risk assessment and risk register maintenance
Regulatory risk identification and compliance gap analysis
Operational risk monitoring and incident management
Risk appetite framework definition and breach monitoring
Control effectiveness testing and residual risk recalculation
Board-level risk reporting and risk committee support

Related Governance Risks

Unidentified risks due to infrequent or ad-hoc risk assessments
Inadequate controls leading to higher residual risk than reported
Risk appetite breaches going undetected due to lack of monitoring
Emerging risks not identified before they materialize into incidents

Related MPG Modules

Frequently Asked Questions

What risk assessment methodologies does MPG support?

MPG supports configurable risk assessment templates with custom likelihood and impact scales, scoring formulas, and risk categories. You can use standard methodologies like ISO 31000, COSO ERM, or define your own organization-specific approach.

How are controls connected to risks?

Every control in MPG can be linked to one or more risks. When a control is tested, the test result feeds into the residual risk calculation, automatically updating the risk score based on control effectiveness.

Can I define a risk appetite framework?

Yes. MPG lets you define risk appetite statements and tolerance thresholds for each risk category. The system automatically flags when residual risk exceeds appetite and can trigger treatment plans, escalations, and board reporting.

How does continuous monitoring work?

MPG continuously monitors risks through linked KPIs, assessment results, control test outcomes, and risk signals. When a monitored metric breaches a threshold, the system updates the risk status and can trigger alerts or treatment actions.

Can I generate risk reports for my board?

Yes. MPG provides configurable risk reports including risk heatmaps, top risk summaries, treatment progress, appetite breaches, and trend analysis — all exportable for board packs and risk committee meetings.

Ready to strengthen your governance with Governance Risk Management?

Join organizations using My Premium Governance to transform their governance, oversight, and compliance operations.