Risk and Compliance
ISO 31000 risk software for schools
Inherent to residual, with the appetite the board approved.
ISO 31000 asks a school to identify, analyse, evaluate, treat, monitor and report its risks against an appetite the board has set.
EthosOne's risk register is ISO 31000 risk software for schools, part of the Risk and Compliance module.
One organisation-approved matrix, one set of categories and one appetite apply to every register the school keeps: board, ICT, AI and operational.
What we keep hearing
It is 2:00 and the audit committee meets at four. The risk and compliance manager has the matrix in one spreadsheet, the appetite statement in a board minute from two years ago and the register in a third file that agrees with neither. Cyber sits at Medium because it has always sat at Medium, and somebody at four will ask which control earns it. Before the committee sits, the rating still has to be earned.
This is the room where the control that earns it is named, with the appetite the board approved beside it.
Six views, one picture. Each one reads from the same live records.
01Risk home
The catalogue of every register in the school, searchable and filtered by status and owner. Board, ICT, AI, ELC or operational and any other material register each carry a scope and an owner.
02Risk settings: one matrix, one appetite
Settings are made once for the organisation and apply to every register in it, which is what makes a rating mean the same thing twice.
03Register detail: the board's view of exposure
The register is what the board opens. It is built to be decision-useful before anyone opens a single risk.
04Risk detail: cause, controls, treatments
The detail follows the ISO 31000 order, and the order is the point: inherent exposure, then the controls that hold it, then the residual rating that results.
05Risk review: appetite, acceptance and escalation
While residual sits above the appetite for its category the risk shows "Residual risk is above appetite" and requires either a dated, owned treatment with rationale or a formal acceptance by the right authority. The review records the authority, the decision and the review date.
06Group risk
For a group, a diocese or a school with several entities, Group Overview shows risk by level, category and entity, and each record keeps its entity and source identity. Group Management is a Premium module; see the group management page.
The register is the front of the accountability spine. A risk names its controls and treatments, each names an owner, the owner's work appears in Actions, assurance logs record what happened, board reports carry current exposure and snapshot movement to the meeting, and the board's decision returns as an acceptance or escalation on the risk. Risk assessments sit beside the register for operational work.
Return to the complete school risk management software view, including assessments, duty of care and board reporting.
An embedded helper, aware of your school's context, drafts inside the register.
It suggests board-reportable domains the school may be missing, drafts risk, control, treatment and appetite wording with the rationale shown, proposes control test steps and treatment success criteria, identifies orphaned, overdue or weak-control patterns, summarises movement between snapshots and drafts the briefing for a review. The matrix scores and a person decides. The helper does not change scoring, calculate a rating or accept a risk; every draft is a proposal a named person reviews and applies.
Sovereign frontier AI, hosted in Sydney and Melbourne.What it does not do
- It does not use the risk register as an in-situ task or equipment assessment.
- It does not accept a residual score without controls and a treatment rationale.
- It does not let a control or a treatment sit without an owner.
- Stored in AustraliaAWS Sydney and Melbourne, one database per school
- AI stays in the country tooHosted in Sydney and Melbourne; never trained on your content
- Published, not describedTrust Centre · ISMS policy · How we handle your data
“School governance and risk is a complex area without a clear solution, a time-poor disconnect with governance and risk management that relies on Frankenstein models of electronic and paper-based reporting and measuring.”
David RuggieroPrincipal, Blackfriars Priory SchoolThe six we are asked every time.
Still weighing something up? Thirty minutes with us, on your own registers, answers the rest.
Book your school a demo01Is EthosOne ISO 31000 certified?
ISO 31000 is a framework for managing risk, not a certification scheme for software, so no product is certified to it. EthosOne's register follows its structure, with appetite set by governance.
02What is the difference between a control and a treatment?
A control is an existing measure that already reduces inherent exposure and justifies the residual rating. A treatment is planned work to change residual exposure further, with an owner and a due date; EthosOne keeps them as separate records.
03What happens when a risk is above appetite?
The risk shows an escalation and stays in the Above appetite status until it has a dated, owned treatment with rationale or a formal acceptance by the right authority, recorded with the review date.
04Can we import our current register and matrix?
Yes. Settings, registers and their nested controls and treatments are imported together, and the import validates as a whole or returns precise row-level failures.
05What should our risk register look like?
A board-ready register is one where every risk has a named owner, a treatment plan and evidence that the control is working. EthosOne builds registers to ISO 31000, so inherent and residual ratings, controls and treatments sit on the same record.
Around half the risk material schools send us turns out to be operational risk assessments rather than a strategic register. Rebuilding it as a governed spine is usually the first job.
The board view then shows which risks sit outside appetite this week, which controls were assessed as not effective, and who is treating them. The same register feeds the board report, so the number in the pack traces back to the risk it came from.
06Risk and Compliance, in full: what does it cover?
Each risk records its event, cause, consequence, category and owner, an inherent likelihood and impact, the controls that reduce it, the residual rating that results and the treatments planned to move it further. Snapshots preserve the board's baseline, and the review records acceptance or escalation by name. It is for risk owners, business managers and chairs, and it is included in the Focus module at $5,000 a year on top of Core.
What are the AI paragraphs you are currently missing from your policies? Watch how we do it.
Free, under ten minutes, and yours to keep whether or not you talk to us.
More free templates and tools
Risk Appetite Statement
Free Risk Appetite Statement for independent schools: Risk-Appetite-Statement.docx with a worked example, a four-page How-to and the What-next brochure for EthosOne Risk Management. Nine sentences your board can vote on.
AI Risk Register
Free AI Risk Register for independent schools: AI-Risk-Register.xlsx with a worked example, a four-page How-to and the What-next brochure for EthosOne Risk Management. Twelve AI risks on your register before the board asks.
Walk into the audit committee alreadysure which control earns the rating.
Risk and Compliance: $5,000 a year with no per-user fees.
