To run a review cycle, set a review frequency on each risk, then record a review from the risk detail page whenever it falls due. Each review updates the residual score, advances the next review date from the cadence, and adds an entry to the review history. Owners are reminded automatically when a review is due soon or overdue.
Why reviews matter
Residual exposure shifts as your controls mature and your environment changes. Regular reviews keep every residual score current and give auditors a clear, dated history of how each risk has been reassessed over time.
Set a review cadence
On the risk form, choose a Review Frequency of monthly, quarterly, annually, or ad hoc. ISO Mate uses this cadence to suggest the next review date each time you record a review. An ad hoc frequency does not pre-fill a date, so you schedule the next review yourself when you want one.
Record a review
- Open the risk and click Record review.
- Rate the current likelihood and impact from 1 to 5. The score and level band preview updates as you choose.
- Add notes describing what changed.
- Set an explicit next review date if you want to, otherwise ISO Mate pre-fills it from the cadence.
- Click Save Review.
Saving updates the residual likelihood and impact, recomputes the residual score, level band, and over appetite flag, sets the last reviewed date, advances the next review date, and appends the review to the history timeline. The history is kept in full so nothing is overwritten.
Due and overdue reminders
Risk owners are notified when a review is coming due and again once it becomes overdue, so nothing slips through the cracks. If a review pushes the residual level higher, the owner also receives an escalation notification. In the register you can filter by review status to see risks that are overdue, due soon, or have no review scheduled.
Related articles
Keep your risk reviews on track. Start your free 14-day trial.