Score it. Treat it. Prove the controls work.

Score it. Treat it. Prove the controls work.

5×5, 3×3, N×M, FMEA, and custom methodologies — with snapshot-at-approval versioning so historical assessments never silently re-band.

Available as an add-on on Professional, included on Enterprise.

Audit-grade by default

Chain proofEvery state change is hash-chained and verifiable. Re-derive the hash yourself.E-signaturesRe-authenticated, content-bound, 21 CFR Part 11-shaped, separation-of-duties enforced.Regulatory reportsOSHA 300/300A/301, RIDDOR F2508, ISO NCRs, GDPR Article 33 — on demand.One connected recordSOP ↔ deviation ↔ CAPA ↔ inspection ↔ incident ↔ risk ↔ asset. Never re-keyed.
The job

What teams do today — and why it hurts.

Most risk registers are static 5×5 grids in Excel. Methodology changes don't version — they overwrite. SOP controls aren't linked, so nobody knows whether updating an SOP changed the residual on the risk it controls. Treatment plans live in yet another tool.

How it works in ForgeSOP

One workspace. One audit trail. One transaction.

Pick a methodology — 5×5 default, 3×3, N×M, FMEA, or custom. The methodology is versioned; approving a risk freezes the methodology snapshot onto the assessment so historical decisions stay readable forever. Controls reference SOP versions and have effectiveness multipliers (DESIGNED 0.95, IMPLEMENTED 0.75, VERIFIED 0.50). Treatment plans spawn CAPAs. The heatmap and what-if preview run client-side — no server round-trip.

[ Product screenshot — risk management workflow ]
Key capabilities

What you actually get when you turn Risk Management on.

Multiple methodologies
5×5 default, 3×3, N×M for specialized teams, FMEA with severity / occurrence / detection, or your own custom methodology. Switching methodologies versions the change.
Methodology versioning
Every approved risk freezes the methodology snapshot. Re-band the matrix tomorrow and yesterday's residuals stay correct. No silent re-rating.
Live what-if preview
Drag a control or change a likelihood; the residual recomputes in the browser without a server round-trip. Decisions happen at the speed of thought.
Treatment plans → CAPAs
Mitigations spawn typed CAPAs. Closing the CAPA recomputes the residual on close. The arc from finding to verified control is one click of evidence.
Control effectiveness
Multipliers per maturity stage: DESIGNED 0.95, IMPLEMENTED 0.75, VERIFIED 0.50. Verifying a control demonstrably reduces residual — your auditor sees the math.
Heatmap & Risk Pack
Heatmap by site, asset, or category. Risk Pack export for board reporting: cover, methodology snapshot, top-N risks, residual movement, and the chain proof.
The artifact

Heatmap on screen. Risk Pack on the desk.

Live heatmap with drillable cells. Risk Pack PDF with cover, methodology snapshot, top-N risks, treatment status, and the audit-trail chain. Designed to ship to a board, not to a regulator alone.

# Risk Management — exported artifact ───────────────────────────────────────── workspace_id: ws_8f2a… site_id: site_p201_milwaukee version: v3 (approved 2026-04-22) signatories: j.kim (Author), r.patel (Approver) hash: 3c6a…b91f ← chain head prev_hash: a08e…472d ← verifies on auditor's machine ─────────────────────────────────────────
The wedge

Not an integration. The same database.

SOPs become controls; publishing a new SOP version bumps effectiveness on every linked risk. Audit findings open as risk events in the inbox. Treatment plans spawn CAPAs typed as RISK; closing the CAPA recomputes residual. Methodology snapshots ensure no module update silently re-bands historical work.

Compliance & evidence

What this satisfies.

ISO 31000 (risk management)ISO 9001 (risk-based thinking)ISO 45001 (OH&S risk)COSO ERMFMEA (AIAG-VDA, IEC 60812)

"Shape" means we mirror the regulation's evidence, signature, and audit-trail requirements in our data model. Where we say "aligned," that's a customer affirmation; where we say "certified," we link the report. See Trust & Security for the current certification state.

Security & access

RBAC, RLS, and a hash-chained audit trail.

Assessor cannot approve their own assessment under default separation of duties. Approval requires re-authentication and binds the signature to the methodology snapshot. Workspace-isolated by RLS.

Read the full security architecture →
"

The methodology-versioning thing sold us alone. Our previous tool let people silently re-rate historical risks; ours lets the auditor see exactly what we knew at the time.

Head of Risk · Energy operator, 8 sites
Adjacent modules

What this connects to.

Audits & Inspections
Run the inspection on your phone. Hand over the evidence pack.
Quality Management
Deviations & CAPA — quick intake to e-signed closure.
Workplace Safety
Hazards, JSAs, near-misses, permits — caught early, closed cleanly.

Forge better processes

One platform. Always audit-ready.

Bring SOPs, checklists, audits, incidents, and CAPAs into one connected system for safer, clearer, and more consistent operations.

Book a demo →Start free trial

No credit card required · Built for teams that run on process