Skip to content
Take the AI maturity assessmentBook your school a demo
Risk and Compliance

School risk management software for independent schools

A risk register that is real, not a tick-box exercise.

The risk the board signs off and the control a teacher runs in the lab on Thursday are the same record.

Book your school a demoSee the free pack
A risk open in the AI Risk Register, the Year 9 science practical: the five-by-five matrix with the inherent rating of 15 and the residual of 4 drawn as From and To, the category, and the four controls the draft proposed beneath.
Risk Assessments register for the demo school showing draft and approved activity assessments, hazards, dates, assessors and approval owners.
Approved filter in the demo school risk assessment register showing the approved teaching and student learning assessment and its approver.
EthosOne Add Hazard form with cause, consequence, likelihood-impact matrix, responsible user, controls and a nested response editor.

Real captures · Focus module · demo school.

In one paragraph

EthosOne is governance, risk and compliance software built only for schools, and Risk and Compliance is the module where the board-reportable risk register lives.

Separate registers for board, ICT, AI and operational risk run under one organisation-approved matrix, one set of categories and one appetite.

The problem

The register is a spreadsheet with a version number in the file name. It was current the day it was saved. Nobody can say who operates the control against the second risk, whether the treatment on the fourth was ever finished, or which version the board saw. A regulator asks for the position; the school has a file.

A risk assessment and a risk register look alike and are not. The register is the board's summary of exposure, rated against appetite. An assessment is the analysis of one kiln, one camp, one contractor on one day. Schools that keep them in one document either frighten the board with operational detail or hide operational hazards inside a strategic rating.

Duty of care is proven after the fact. The consent forms are in a folder, the ratio was right on the day, the medical list was on someone's phone. When the question comes, the evidence exists and cannot be produced, and the difference between those two states is the whole of the school's defence.

A deputy principal and an outdoor education coordinator going through a camp plan in the school store room.

What we keep hearing

A student was injured at the athletics carnival. The student made a full recovery. The regulator has opened a file and is considering prosecution, and the first letter asks two questions. Can the school prove that a risk assessment was conducted for that event, by whom, and when it was approved? Was the assurance in place on the day: the first aid kit checked, the supervision ratios met, the hazard on the long jump run-up known and controlled? The answer in most schools is a folder, a memory and a hope.

This is the room where the answer is a record with a date on it.

Free template pack

Risks and hazards in one workbook, linked

A register with an owner and a review date on every row, a heat map your committee can read, and a board summary ready to table.

What it does

Eight views, one picture. Each one reads from the same live records.

  • A risk open in the AI Risk Register, the Year 9 science practical: the five-by-five matrix with the inherent rating of 15 and the residual of 4 drawn as From and To, the category, and the four controls the draft proposed beneath.
    01

    ISO 31000: inherent and residual

    Every risk carries an inherent rating and a residual one on the same five-by-five matrix, with the rating trail that explains the movement: cause and consequence first, then the inherent rating, then the controls, then the residual. A change in likelihood or impact recalculates the rating, the level and the appetite comparison from the same scale, so every number is reproducible and the board reads one language across every register.

  • EthosOne Risk home listing separate AI, operational, financial and school board risk registers with scope and owners in the
    02

    Registers

    Separate registers for the board, ICT, AI, an ELC or operations, and any other material register the school keeps, each with a scope and an owner, under one set of categories, one scoring scale and one appetite. A new register begins with a title, a manager, a scope and its context, and every row records the event, the cause, the consequence, the category, the owners and both ratings, so a risk is decision-useful before anyone opens it.

  • The Review AI Risk Draft panel in the AI Risk Register: a Year 9 science practical named as the risk, the drafted cause and consequence as bullet lists, the AI-suggested rating beneath, and Regenerate and Create Risk buttons.
    03

    Draft with AI

    Name the activity, the site or the concern and the helper drafts the risk from the school's own categories, with a cause, a consequence, the controls most schools already have and the treatments most still need, for the owner to accept, edit or reject. On a risk assessment it drafts the hazards and their responses the same way.

  • Every control and treatment on the School Board Risk Register with its owner, dates and status, filterable by type and state.
    04

    Controls and treatments

    Controls are what already reduce inherent risk: title, description, owner, status, evidence and review basis. Treatments are the planned change to residual exposure: owner, status, due date, attachment and intended effect.

  • Accountability for a risk in EthosOne, showing the named risk owner, risk lead and risk manager against it.
    05

    Assignments and due dates

    Every risk, control and treatment has a named owner, a status and a due or review date, and each treatment shows in its owner's accountability dashboard alongside their actions, so the work is seen with the rest of what they carry. Nothing on the register is nobody's.

  • Risk Settings, Risk Appetite: the four-band appetite scale from Very low to High, then every category with its appetite band and the statement the board approved, Corporate Services Operations at Medium with its statement written out.
    06

    Risk appetite

    Appetite levels and statements by category, approved by governance and applied to every register, so the above-appetite state on a risk reflects what the board actually decided. While residual exposure sits above appetite the risk shows an escalation, until it has a dated, owned treatment with a rationale or a formal acceptance by the right authority, with who decided, what was decided and the review date on the record.

  • The snapshots tab of the School Board Risk Register: named point-in-time captures with dates and a Compare action.
    07

    Risk snapshots

    A named snapshot preserves the register exactly as it stood before a board meeting. Two snapshots compared show the movement between meetings: which risks rose, which treatments closed, which controls lapsed.

  • The AI Risk Register overview: the scope and context, then the risk distribution as two five-by-five heat maps, inherent on the left and residual on the right, with the count of risks in each cell.
    08

    Reporting

    The risk distribution by level and category against appetite, the material risks with their owners and treatments, and the movement since the last snapshot, drawn from the live register into the dashboard and the board pack. For a group, a diocese or a multi-campus school, the group lens shows every entity's risk by level, category and entity, and each record keeps its school's identity in the consolidated picture.

What it does not do

  • It does not use the risk register as an in-situ task or equipment assessment; that work belongs in risk assessments.
  • It does not accept a residual score without controls and a treatment rationale behind it.
  • It does not let a control or a treatment exist without an owner.
Customer stories

Made for the people who run their school.

Frequently asked questions

The seven we are asked every time.

Still weighing something up? Thirty minutes with us, on your own registers, answers the rest.

Book your school a demo
  1. 01Do you have a risk register?

    Yes. The board-reportable risk register is the heart of Risk and Compliance: separate registers for board, ICT, AI and operational risk under one organisation-approved matrix, one set of categories and one appetite, every risk with a cause, a consequence, an owner and inherent and residual ratings, and every control and treatment with a named owner, a status and a due or review date. It is a live register the board opens at any time, not a document.

  2. 02Can EthosOne do risk assessments?

    Yes. Risk assessments sit in the Risk and Compliance module beside the board's risk register: the register is the board's view of exposure, and a risk assessment is the operational analysis of one activity, site or item. A camp or excursion runs as its own activity-specific assessment, approved before departure. The venue is captured with the assessment at the time it is done, so a new venue means a new assessment.

  3. 03What is a school risk register?

    The board's list of the risks that matter to the school, each with a cause, a consequence, an owner, inherent and residual ratings, and the controls and treatments that hold it there. In EthosOne it is a live register the board can open at any time, not a document.

  4. 04How many registers can a school keep?

    As many as it has material domains. Most begin with a board register and add ICT, AI and operational registers, all under the one matrix, categories and appetite so a rating means the same thing in each.

  5. 05Is EthosOne aligned to ISO 31000?

    The structure follows ISO 31000: identify, analyse, evaluate, treat, monitor and report, with appetite set by governance. ISO 31000 is a framework rather than a certification scheme for software; the ISO 31000 page shows the register in depth.

  6. 06What is the difference between a risk register and a risk assessment?

    The register is the board's view of exposure. A risk assessment is the operational analysis of one activity, site or item, and EthosOne keeps them in separate modules.

  7. 07Focus module, in full: what does it cover?

    Every risk carries a cause, a consequence, an owner and inherent and residual ratings, and every control and treatment carries a named owner, a status and a due or review date. Risk assessments, camps and excursions, the compliance calendar and assurance logs share the module. It is a Focus module at $5,000 a year on top of Core, for business managers, principals, chairs and risk officers.

Built to scale

Run at any scale. From one campus to a diocese, with every entity reporting the same way.

Switch
from your existing platform, for a low cost
25
policy domains help you make sense of the policies you have, and the ones you need
Every regulator
in Australia and New Zealand supported
Safe
data, processing and AI based in Sydney and Melbourne via AWS

Coverage spans the eight Australian states and territories, with Commonwealth law applying across all of them, and separately New Zealand. Domain figures come from the PolicyAI Research Atlas.

Powered byAccuFind

PolicyAI answering the prompt “Draft me an AI Acceptable Use Policy.”, then working through: Reading the AI-engaged obligations; Matching privacy, records, child safety; Drafting against your existing library.

AI governance

Solutions for every school’s AI challenge.

There is no AI-specific legislation in force in Australia or New Zealand. The duties your school already carries are the ones AI engages.

Take the AI maturity assessment

Governing AI, before your board asks again.

“The board asked what our position on AI is, and we did not have one.”

Data privacyAlgorithmic biasSynthetic mediaAutomated decisionsRecords governanceSurveillance

An AI policy is not a new rulebook, it is a lens over duties your school already carries: privacy, records, discrimination and child safety, engaged by an AI-shaped set of facts. Which is why a downloaded template does not survive contact with a regulator.

We have tagged the duties AI activity in a school engages, so the conversation starts from the obligations you already hold rather than from a blank page. Almost none of them say “AI”.

Try Draft with AI.Five paragraphs against the obligations of your State, with the provision beside each. Free, no login.