risk-register-ai

▶ Live demo · Streamlit + GPT-4o

Turn raw audit findings into a scored, framework-mapped risk register.

Paste your findings, pick a framework, and get back a formal risk register with inherent and residual scoring, treatment decisions, control references, and an audit-ready CSV export.

Built with Streamlit + GPT-4o. Part of a GRC automation toolkit alongside control-crosswalk, grc-gap-ai, and ir-playbook-gen.

---

Why

Audit findings arrive as prose. Risk registers need structure: an asset, a threat, a vulnerability, a likelihood, an impact, a treatment decision, and an owner. Doing that conversion by hand is slow and inconsistent between analysts.

This tool does the conversion and keeps the scoring deterministic, so two runs over the same findings produce comparable registers.

What it produces

For each finding, one risk entry containing:

Field	Description
risk_id	Sequential identifier (R-001, R-002, …)
title	Short risk statement
description	Risk expressed as threat exploits vulnerability causing impact
asset / threat / vulnerability	The three components of the risk scenario
likelihood / impact	Inherent scoring, 1–5 each
inherent_score / inherent_band	Product and qualitative band
existing_controls	Controls already in place
treatment	Mitigate, Transfer, Avoid, or Accept (ISO 31000 vocabulary)
residual_*	Scoring after the proposed treatment
risk_reduction	Points of risk removed by the treatment
owner	Accountable role
control_refs	Control identifiers from the selected framework

Scoring model

A standard 5×5 qualitative matrix. Score is likelihood × impact:

Score	Band
1–4	Low
5–9	Medium
10–15	High
16–25	Critical

Scoring, banding, aggregation, and export are pure Python with no LLM involvement — the model proposes the 1–5 inputs, the code does the arithmetic. That keeps the numbers reproducible and testable.

Supported frameworks

• ISO/IEC 27001:2022 (Annex A)
• NIST CSF 2.0
• NIS2 (Directive 2022/2555)
• DORA (Regulation 2022/2554)

Install

git clone https://github.com/workmcg/risk-register-ai
cd risk-register-ai
pip install -r requirements.txt

Run

export OPENAI_API_KEY="sk-..."
streamlit run app.py

Or leave the environment variable unset and paste a key into the sidebar.

Try it with the included sample:

# then upload examples/sample_findings.txt in the "Upload file" tab

Input formats

Findings can be pasted or uploaded as .txt, .md, or .csv. The parser handles:

• dash or bullet lists (-, *, •)
• numbered lists (1., 2))
• blank-line-separated paragraphs

Wrapped continuation lines are joined back onto their parent finding.

Development

pip install -r requirements-dev.txt
python -m pytest -q

The test suite covers scoring boundaries, band edges, findings parsing, ID assignment, malformed-LLM-response handling, aggregation, and export format — without requiring an API key.

Project layout

risk-register-ai/
├── app.py                    # Streamlit UI
├── src/
│   ├── risk_engine.py        # scoring, parsing, aggregation, export
│   └── llm.py                # prompt construction + response parsing
├── tests/
│   ├── test_risk_engine.py
│   └── test_llm.py
├── examples/
│   └── sample_findings.txt
└── .github/workflows/tests.yml

risk_engine.py imports neither Streamlit nor OpenAI, so the core logic is testable in isolation.

Limitations

• The model proposes likelihood and impact values. Treat them as a first draft for analyst review, not a final assessment.
• Control references should be verified against the source standard before they go into an audit deliverable.
• This tool does not replace a risk assessment methodology; it accelerates the transcription step within one you already have.

Licence

MIT — see LICENSE.