Help & User Guide

Visit risk3y.com and click Get started free. Enter your work email address and choose a strong password. You will receive a verification email — click the link inside to activate your account.

Once verified you will be prompted to create your organisation workspace. Choose a name that your team will recognise (e.g. "Acme Corp"). You can always change this later in Settings → Organisation.

Go to Settings → Members and click Invite member. Enter their email address and choose a role:

• Risk Manager — full create/edit/archive access across all registers
• Risk Contributor — can add and edit risks, but cannot archive
• Risk Reviewer — read-only access with the ability to record reviews
• Read-only — view-only access, cannot make changes
• Billing Admin — manages subscription only, no risk access

The invitee receives an email with a sign-up link. Once they accept, they appear in your member list. Your plan's member limit applies — upgrade if you need more seats.

From the Dashboard, click New register. Give it a descriptive name such as "Enterprise Risk Register 2026" or "Project Alpha Risks". An optional description helps team members understand scope.

Registers are isolated — risks in Register A are not visible in Register B. You can create one register per project, department, or compliance framework.

Once created, open the register and click Add risk to start populating it.

A risk register is a central log of all known risks for a given scope (e.g. a project, business unit, or compliance area). Each risk records:

• A title and description of the risk event
• Top event and consequences
• Likelihood and consequence scores (1–5 scale) producing a risk score
• Controls in place and their effectiveness
• An owner responsible for managing the risk
• A review schedule

Inside a register click Add risk. At minimum you must provide a title. Additional fields — description, top_event, consequences, scores, owner, and review frequency — can be filled in now or updated later.

Risk Score = Likelihood × Consequence. A 5×5 score is the maximum (extreme risk). Use your organisation's risk matrix to interpret scores.

Risk3y uses a 5×5 likelihood/consequence matrix. Scores are calculated automatically:

The numeric score (1–25) maps to a level label and colour defined by your organisation's active risk matrix — for example Low, Medium, High, or Extreme. Admins configure the exact thresholds and labels in Settings → Risk Matrix. If no custom matrix is active, the raw score is shown.

Both initial (inherent) and residual (after controls) scores can be recorded. The residual score reflects the risk level after your controls are applied.

Each risk moves through the following statuses:

• Open — Active risk requiring attention
• Mitigated — Controls are in place and residual risk is acceptable
• Accepted — Risk is known and formally accepted by a risk owner
• Archived — Risk is no longer relevant; removed from active views

Only Risk Managers can archive risks. Archived risks are hidden from the default list but remain searchable.

Controls are the measures you have in place to reduce a risk. Open a risk and scroll to the Controls section. Click Add control and describe the control, its type (preventive, detective, corrective), and effectiveness.

Controls contribute to the residual risk score — after applying controls, update the residual likelihood and consequence fields to reflect the reduced exposure.

Evidence links supporting documentation to a risk (e.g. audit reports, testing results, certificates). Open a risk and click the Evidence tab. Click Add evidence, provide a label (e.g. "ISO 27001 Cert 2026"), and paste the URL to the document.

Evidence is immutable once added — to update a link, delete the old entry and add a new one. All evidence additions and deletions are recorded in the audit log.

When creating or editing a risk, set Review frequency (Monthly, Quarterly, Semi-annual, Annual) and a Next review date. Risk3y will send an email reminder to the risk owner when the review date approaches.

To record that a review occurred, open the risk and click Record review. Enter any notes and the system will calculate the next due date automatically based on the frequency.

The Dashboard highlights risks whose review date has passed. Navigate to Dashboard → Overdue reviews to see the full list.

Click any overdue risk to open it and record a review. Regularly completing reviews demonstrates a functioning risk management process and satisfies most compliance frameworks.

To bulk-import risks, open a register and click Import. Download the CSV template and populate it with your data. Supported columns include: title, description, top_event, consequences, status, likelihood, consequence, and owner_job_role_id.

Click Preview import to validate your file before committing. Any rows with errors are highlighted — fix them in your spreadsheet and re-upload. A successful import creates all valid rows; errored rows are skipped.

Open a register and click Export → CSV. All visible risks (respecting any active filters) are included. The export can be opened in Excel, Google Sheets, or any spreadsheet application.

Open a register and click Export → PDF report. An HTML report opens in a new tab — use your browser's Print → Save as PDF function to save it. The report includes a summary table of all risks, colour-coded by status and score.

MCP (Model Context Protocol) is an open standard that allows AI assistants (such as Claude, Copilot, or any MCP-compatible client) to securely interact with Risk3y data using natural language.

With MCP enabled, you can ask your AI assistant things like "Summarise the top 5 risks in the Enterprise register" or "Create a risk for supply chain disruption with likelihood 4, consequence 3" — and it will act directly in Risk3y on your behalf.

Go to Settings → MCP Clients and click New API Key. Choose a name, select your scopes, and click Create. You will then see two connection options:

• Connector URL — for Claude.ai and Claude Desktop. Copy the URL shown (format: https://mcp.risk3y.com/connect/<token>/mcp) and paste it into Claude → Settings → Connectors → Add custom connector. No separate API key entry is needed — the credential is embedded in the URL.
• Raw API key — for Claude Code or a self-hosted MCP server. Set the key as the RISK3Y_MCP_API_KEY environment variable in your MCP server config.

Save the Connector URL or API key immediately — it is shown only once. If lost, revoke the key and create a new one.

Keys are scoped to your tenant and honour the permissions of the user who created them.

Risk3y exposes the following tools to MCP-compatible AI clients. Write tools are disabled when the key is read-only.

Tool list synced to live MCP server on 2026-06-21.

Discovery & metadata

• register_list — List all accessible registers
• job_role_list — List job roles for a register
• group_list — List risk groups for a register
• team_list — List tenant members with user IDs
• matrix_get — Get the active risk matrix
• share_list — List share links for a register (admin key required)

Read tools (always active)

• risk_search — Search risks with optional filters (status, critical, tag, min score, overdue, pagination)
• risk_get — Retrieve a specific risk including controls and reviews
• risk_summary — Summarise a register's risk landscape
• risk_generate_report — Generate an analytical report

Write tools (read-only keys cannot use these)

• risk_create — Create a new risk
• risk_update — Update risk fields
• risk_archive — Archive a risk
• risk_delete_permanent — Permanently delete a risk (explicit confirmation required)
• risk_copy — Copy a risk and its controls to another register in the same organisation
• risk_bulk_update — Remap a field value across many risks at once (e.g. reassign all risks owned by a departing team member)
• risk_add_control — Add a control to a risk
• risk_list_controls — List controls on a risk
• risk_update_control — Update a control
• risk_archive_control — Archive a control
• risk_delete_control — Soft-delete a control
• risk_delete_control_permanent — Permanently delete a control (explicit confirmation required)
• control_bulk_update — Remap a field value across many controls at once (e.g. normalise effectiveness labels)
• risk_record_review — Record a risk review
• risk_change_proposal — Propose a change for human approval
• risk_propose_knowledge_update — Propose a knowledge update
• risk_propose_controls — Propose new controls
• register_knowledge_update — Update the register knowledge base directly
• group_create — Create a risk group
• group_update — Rename or reorder a risk group
• group_delete — Delete a risk group
• job_role_create — Create a job role and optionally assign a team member
• job_role_update — Update a job role name, department, or assigned user
• job_role_delete — Delete a job role
• share_create — Create a public share link with configurable field visibility and optional expiry (admin key required)
• share_revoke — Revoke a share link immediately (admin key required)
• register_settings_update — Update register description, mode, or AI approval settings (admin key required)

HSE Prosecution Intelligence

• prosecution_search — Search NZ and AU WorkSafe prosecution cases
• prosecution_get — Full case details including knowledge notes and judgement documents
• prosecution_stats — Counts by year, legislation, and jurisdiction
• prosecution_field_values — List distinct values for a field (e.g. all industry labels with counts) — useful before bulk cleanup

Advanced mode tools (advanced registers only)

• threat_list — List threats for a risk
• threat_add — Add a threat (write mode only)
• threat_update — Update a threat (write mode only)
• threat_delete_permanent — Permanently delete a threat (write mode only)
• education_list_methods — List education / training methods configured for the register
• education_add_method — Add an education method (write mode only)
• prosecution_document_get_text — Extract readable text from stored prosecution documents
• education_update_method — Update an education method (write mode only)
• education_remove_method — Remove an education method (write mode only)

Critical Risk Verification tools (add-on required)

• verification_rounds_list — List verification rounds
• verification_round_get — Get full round detail
• verification_checks_list — List checks in a verification round
• verification_round_create — Create a draft verification round
• verification_round_start — Start a verification round
• verification_tags_list — List verification group tags
• verification_regions_list — List verification regions
• risk_verification_tags_list — List verification tags assigned to a specific risk
• risk_verification_tag_add — Assign a verification tag to a risk
• risk_verification_tag_remove — Remove a verification tag from a risk
• risk_verification_regions_list — List verification regions assigned to a risk
• risk_verification_region_add — Assign a verification region to a risk
• risk_verification_region_remove — Remove a verification region from a risk
• verification_summary — Dashboard summary for a register
• corrective_actions_list — List corrective actions (filter by status)
• corrective_action_create — Create a corrective action linked to a risk or verification check (requires corrective_action:create scope)
• corrective_action_update — Update a corrective action status, owner, due date, title, or priority (requires corrective_action:update scope)
• corrective_action_history — View the corrective action timeline, including status changes and notes (requires corrective_action:readscope)
• corrective_action_add_note — Add a progress note without changing status (requires corrective_action:update scope)
• corrective_action_direct_close — Close a corrective action without the review step (requires corrective_action:close scope)
• maturity_assessments_list — List all GHSL maturity assessments for the register
• maturity_assessment_create — Record a new 9-question GHSL maturity assessment (write mode only)
• survey_list — List worker consultation surveys (requires consultation:read scope)
• survey_get — Get full survey detail including questions (requires consultation:read scope)
• survey_report — Get full survey report: recipients, responses, and summary (requires consultation:read scope)
• survey_create — Create a draft worker consultation survey (requires consultation:write scope)
• survey_send — Activate a survey and send to recipients (requires consultation:write scope)
• survey_close — Close an active survey (requires consultation:write scope)

Each MCP API key is permanently scoped to a single client tenant — it cannot access data from any other organisation. This is a deliberate security boundary that ensures your clients' risk data stays isolated.

How consultants work across multiple clients

For each client you manage, create a separate MCP API key inside that client's Risk3y organisation (you must be a member of their workspace). Configure your AI tool with one server entry per client:

• Claude Desktop — add a separate connector entry in claude_desktop_config.json for each client, each with its own Connector URL or API key. Name them clearly, e.g. Risk3y – Client A and Risk3y – Client B.
• Claude.ai / Connectors — add one custom connector per client using each client's unique Connector URL. Switch between them by selecting the relevant connector at the start of a conversation.
• Claude Code or other MCP clients — configure each client as a named server in your MCP config file. Use the RISK3Y_MCP_API_KEY environment variable or a named profile per client.

Recommended key naming convention

When creating a key inside a client's workspace, use a name that identifies both the client and the purpose, e.g. Acme Corp – Consultant read/write. This makes it easy to audit and revoke keys if access changes.

Scopes to request

• Read-only analysis — risk:read, risk:report
• Full register management — add risk:write, risk:create, risk:archive, risk:controls:write, risk:reviews:write
• Sharing & register settings — risk:share and register:write require an admin-level key (must be created by a user with admin permissions in that workspace)
• Critical Risk Verification — add verification:read, verification:create, verification:assign, corrective_action:read, corrective_action:create, corrective_action:update, corrective_action:close

Tips for consultants

• Call register_list at the start of each session to confirm you are connected to the right client and see all their registers.
• Use risk_generate_report to quickly surface overdue reviews, high-risk items, and control gaps for a client before a site visit or board report.
• Cross-reference client risks against WorkSafe prosecution data using prosecution_search — search by industry or offence type to benchmark their controls against regulator findings.
• Keys are revocable at any time. If a consulting engagement ends, ask the client admin to revoke your key from their Settings → MCP Clients page.

Risk insights are structured observations generated by your connected AI assistant about the risks in a register. Insights highlight gaps, patterns, and improvement opportunities that may not be immediately visible when reviewing individual risks.

Insight types:

• Gap — a specific deficiency in controls, documentation, or scoring.
• Obligation — a policy, regulation, or standard requirement (optionally linked to a specific control).
• Thinking — analytical reasoning or hypothesis being tested.
• WorkSafe — a signal or pattern from WorkSafe prosecution data.
• Board — a board-level decision or directive.
• Event — an incident, near-miss, or external event relevant to the risk.

Insights are created by your AI assistant via MCP and stored against the relevant risk. They appear in the risk detail view under the Insights tab. Open and closed states track the lifecycle of each finding.

Once your AI assistant is connected via MCP, you can ask it to analyse a register and surface insights. Example prompts:

• "Review the Enterprise register and identify risks with no documented controls."
• "Flag any High or Extreme risks that have not been reviewed in the last 90 days."
• "Compare our controls for electrical risks against WorkSafe prosecution findings for the electrical industry."
• "Identify risks where the residual score is still High after controls."

The AI uses the risk_search, risk_get, and prosecution_search MCP tools to gather context, then calls insight_create to record structured findings directly against a risk. It can also use insight_update to fix typos or update content, and insight_delete to archive an insight that is no longer relevant.

To enable AI write proposals (human-in-the-loop), go to Register → Settings → AI write approval and enable it. All AI-proposed changes will appear in the register's proposals queue before being applied.

A gap analysis identifies risks in your register that are under-documented, under-controlled, or overdue for review. You can run gap analysis manually or via your AI assistant.

Common gaps Risk3y surfaces

• High or Extreme risks with zero controls documented
• Risks with no owner assigned
• Risks that are overdue for review (next review date in the past)
• Critical risks with no evidence attached to their controls
• Risks where the residual score equals the initial score (controls may not be reducing exposure)

Using MCP for gap analysis

Ask your AI assistant: "Run a gap analysis on the [Register Name] register and create gap insights for any risk rated High or above with no controls." The AI will search, evaluate, and record structured gap insights you can track to resolution.

Gap insight counts appear as a badge on the risk list and risk detail view, so your team can see which risks need attention at a glance.

Worker Participation is a built-in module that lets you create structured surveys to gather feedback from workers on the risks and controls that affect them. It satisfies the duty to consult workers on health and safety matters (HSWA 2015 s48) and provides an auditable record of worker engagement.

Surveys are scoped to a specific risk in your register. Questions are auto-generated from the risk's bowtie — threats, consequence scenarios, and controls — so workers see exactly the hazards and safeguards relevant to their work. Workers respond via a personalised link or a general public link; no Risk3y account is required.

Key concepts

• Work group — a named group of workers (e.g. "Maintenance Team") with one or more designated Health and Safety Representatives (HSRs)
• Survey — a set of questions sent to a work group, scoped to a risk and its bowtie
• HSR signoff — after responses are collected, the HSR formally reviews findings and signs off to close the consultation cycle
• Corrective action — a follow-up task raised when a survey response identifies a control gap or worker concern

Access Worker Participation from the Consultation tab inside any register.

A work group is a named set of workers who share a common set of risks — for example, "Warehouse Team" or "Site Electrical Crew". Each work group can have one or more Health and Safety Representatives (HSRs) who act as the formal worker representatives under HSWA.

Setting up a work group

1. Open a register and go to Consultation → Work Groups.
2. Click New work group. Give it a name and an optional description.
3. Add HSRs by name and email. HSRs receive signoff requests when a survey closes.
4. Add workers by name and (optionally) email. Named workers receive personalised survey links; anonymous workers use the general public link.

Work groups can be reused across multiple surveys. If a worker changes role, update the group — existing survey records retain a snapshot of the group at send time.

Surveys are created from the Consultation → Surveys tab inside a register.

1. Click New survey. Optionally link the survey to a specific risk — this triggers auto-generation of questions from the risk's bowtie (threats, consequences, controls).
2. Select a work group to define which workers will be consulted.
3. Set a title, optional intro message, and a closes at date. Choose whether anonymous responses are allowed.
4. Review the auto-generated questions. Add, edit, reorder, or remove questions as needed. Question types: Yes/No, Rating (1–5), Free text, Multiple choice.
5. Click Send survey. Named workers receive a personalised email with their unique link. A general public link is also available for anonymous responses or to share via other channels.

Surveys move through Draft → Active → Closed states. A draft can be edited freely; once sent it becomes active and responses begin arriving.

Workers access the survey via their personalised email link or the general public link. No Risk3y account is required — the link opens a public survey form.

If the survey is linked to a risk, the form displays a summary of that risk — including the top event, threats, controls, and consequences — so workers understand what they are being consulted about before answering. On mobile, the bowtie is shown as a collapsible accordion.

Workers answer each question (Yes/No, rating, free text, or multiple choice) and submit. Named recipients are marked as responded; anonymous submissions are accepted without identification if anonymous responses are enabled. Workers cannot submit more than once via their personalised link.

The HSR contact block is shown on the survey form so workers know who their representative is and can raise concerns directly if needed.

When a survey closes (manually or at the closes-at date), open the survey and click View report. The report shows:

• Response rate and total respondents
• Per-question breakdowns — charts for ratings and yes/no, free-text answers listed
• Identified gaps — questions where a significant proportion of workers indicated a control is not effective or not known
• Corrective actions raised from this survey

Raising corrective actions

From the survey detail or report, click Raise corrective action against any finding. The action is linked to the survey and the source risk. Assign an owner and due date, and track it to closure alongside verification corrective actions.

HSR signoff

Once the consultation cycle is complete, request HSR signoff from the survey detail page. The HSR receives an email with a summary of responses and a link to formally sign off. The signed-off timestamp is stored as an auditable record of worker consultation completion.

Risk3y is designed for consultants and advisory firms who manage risk programs across multiple client organisations. Each client's data is fully isolated — a key created inside Client A's workspace cannot access Client B's data.

Getting access to a client

1. Ask the client admin to invite you as a member of their Risk3y organisation.
2. Accept the invitation — you will now appear in their member list.
3. Navigate to their Settings → MCP Clients and create a new API key scoped to the work you will perform.
4. Add the client as a named server entry in your AI tool's MCP configuration (see Connecting an AI assistant).

Key naming convention

Name each key to identify both the client and scope, e.g. Acme Corp – Consultant read/write. This makes keys easy to audit and revoke when an engagement ends.

Risk3y's MCP tools let you generate analysis and reports for clients directly from your AI assistant — without logging into each client portal.

Useful report prompts

• "Generate an executive summary of the top 10 risks in the Enterprise register." — uses risk_generate_report
• "List all overdue reviews and their owners." — uses risk_search with overdue filter
• "Show me risks with no controls that are rated High or above." — combines risk_search and risk_get
• "Compare our electrical safety risks against WorkSafe prosecution cases in the electrical sector." — combines risk_search and prosecution_search

Copy the AI's output into a client report document, or ask it to format findings as a table or bullet list suited to a board paper.

• Start every session with register_list to confirm you are connected to the correct client and see all their registers.
• Use AI write approval mode when making changes on behalf of a client — this routes all AI-proposed changes through a human review queue before they are applied. Enable it in Register → Settings.
• Use prosecution_search before site visits to find relevant WorkSafe or court cases for the client's industry — this adds regulatory context to your recommendations.
• When an engagement ends, ask the client admin to revoke your MCP key from Settings → MCP Clients. You will lose access immediately.
• If you need read-only access for a discovery phase, create a read-only key (no write scopes). Upgrade to a write key only when you begin making changes.
• For boards and exec reporting, use risk_generate_report then refine the output with natural language — "rewrite this as a one-page board summary with a traffic-light table".

Critical Risk Verification (CRV) is an add-on module for organisations that need to confirm — not just document — that their critical risk controls are physically in place and working as intended. It is particularly suited to high-hazard industries such as construction, mining, energy, and manufacturing.

CRV lets you run structured verification rounds: scheduled field checks where a verifier visits a location and confirms each critical control is effective. Findings that reveal gaps generate corrective actions tracked to closure.

Key concepts

• Verification round — a scheduled set of checks targeting one or more critical risks in a register
• Verification tag — a label applied to risks to group them into thematic check sets (e.g. "Electrical", "Working at Height")
• Verification region — a physical location or site area (e.g. "Workshop A", "Level 3")
• Corrective action — a task created when a check fails, tracked through open → in review → closed states

CRV is available as a paid add-on. Contact support@risk3y.com to enable it for your organisation.

A verification round is a structured check that confirms critical controls are in place across one or more risks.

1. Open a register and navigate to Verification in the sidebar.
2. Click New round. Give the round a name (e.g. "Q2 Electrical Checks – Site A") and set a target completion date.
3. Filter risks into the round by verification tag and/or region. You can also set a minimum residual risk score threshold to focus on higher-rated risks.
4. Click Start round. This locks the round and generates a check list — one check per risk included.
5. For each check, the verifier records: Conforms, Does not conform, or Not applicable, plus any notes.
6. Non-conforming checks automatically create a corrective action linked to the risk.
7. Complete all checks to close the round. A summary of pass rate and open corrective actions is shown on the Verification dashboard.

Rounds can also be created and started via your AI assistant using the verification_round_create and verification_round_start MCP tools.

A corrective action is created automatically when a verification check records a non-conformance, or can be created manually against any critical risk.

Corrective action lifecycle

• Open — action identified, awaiting assignment or work to begin
• In review — work completed, pending verification
• Closed — verified effective and formally closed

Managing actions

Open the Verification section and click Corrective actions to see the full list, filterable by status, priority, and due date. Assign an owner, set a due date, and add progress notes as work proceeds.

Via MCP

Your AI assistant can list, update, and close corrective actions using the corrective_actions_list, corrective_action_update, and corrective_action_direct_close tools. Ask it: "Show me all overdue corrective actions across the Site A register and summarise the priority items."

Risk maturity describes how systematically and consistently an organisation identifies, assesses, controls, and monitors its risks. A more mature program reduces the chance of surprises — incidents, regulatory breaches, or reputational damage — because risks are identified early, controls are verified, and the register is kept current.

Maturity levels (simplified)

• Ad hoc — Risks identified reactively. No structured register.
• Developing — Register exists. Risks documented but reviews irregular. Controls noted but not verified.
• Defined — Consistent scoring methodology. Regular review cycle. Controls documented with owners.
• Managed — Controls verified in the field (e.g. CRV). Residual scores tracked. Evidence attached. Corrective actions closed systematically.
• Optimising — AI-assisted gap analysis. Prosecution intelligence informing control design. Maturity metrics reviewed at board level.

Use these indicators to benchmark where your organisation sits:

• Complete register — All known material risks are documented with title, description, likelihood, consequence, and at least one control.
• All risks have owners — Every risk has an assigned job role responsible for its management.
• Residual scores reflect controls — Residual likelihood and consequence are lower than initial scores, demonstrating controls are reducing exposure.
• Reviews are current — No overdue reviews. Review frequency is set and records are logged.
• Critical risks are verified — Critical risks have been through at least one field verification round in the past year.
• Gap insights are low — Open gap count is zero or trending down.
• Evidence is attached — Controls on critical risks have supporting evidence (audits, certificates, test results).
• Corrective actions are closed — No overdue corrective actions from verification rounds.

Risk3y is designed to support the full journey from an ad hoc register to a verified, AI-assisted risk program. Here is a practical progression:

1. Build a complete register — Import existing risks via CSV or add them through the UI. Assign an owner and score every risk before moving on.
2. Set a review schedule — Add a review frequency to every risk and set next review dates. Use the Dashboard overdue view to keep the register current.
3. Document controls — Add at least one control per High or Extreme risk. Record residual scores to show how controls reduce exposure.
4. Connect your AI assistant — Set up MCP and run a gap analysis. Let the AI surface risks with no controls, missing owners, or outdated reviews.
5. Verify critical risks in the field — Enable the Critical Risk Verification add-on and run quarterly verification rounds. Raise corrective actions for any non-conformances found.
6. Use prosecution intelligence — Ask your AI to cross-reference your controls against WorkSafe prosecution findings in your industry. Update controls where regulator cases reveal gaps in your approach.
7. Report to leadership — Use MCP to generate executive summaries and board-ready reports. Track maturity indicators over time to demonstrate improvement.

Each Risk3y plan defines limits on:

• Registers — number of risk registers per organisation
• Risks per register — maximum risks in a single register
• Members — number of users in your organisation
• MCP access — whether AI/MCP integration is available

When you reach a limit, Risk3y will show an error explaining which limit has been reached. Upgrade your plan from Settings → Billing to increase limits.

Go to Settings → Billing and click Change plan. Select the plan that meets your needs and complete checkout via Stripe. Upgrades take effect immediately — limits increase as soon as payment is confirmed.

Downgrades take effect at the end of your current billing period.

All invoices are accessible in Settings → Billing → Invoice history. Click any invoice to view or download a PDF copy. Invoices are also emailed to the billing contact on your account.