machtask.Forms, steps and handoffs for repeatable workYour consolesign in →

case file CF-04 — risk & governance

Controls that actually get executed.

A risk register that lives in a spreadsheet is a list of good intentions. machtask turns incidents, exceptions and reviews into guided work — owned, deadlined, and evidenced as it happens.

fig. 1 — where it breaks todaythe problem
  • the risk register is a spreadsheet
  • incident reports by email thread
  • quarterly reviews that slip a quarter
  • evidence assembled the week before audit
  • policy updates sent by email with no adoption check

Every incident or exception becomes a request with an owner, a severity and a remediation path with sign-offs. When the process changes, you publish once — new work follows the new rules, and old work keeps the version it started with.

fig. 2 — the workflow, as drawn

Raiseincident or exception · anyone reports
owner assigned — clock running
Assessseverity set · treatment decided
remediation — sign-off required
Remediateguided actions · evidence attached
sign-off recorded
ClosedPROCESS v12
fig. 3 — the work, up closerequesters are unlimited and free

Anyone in the business can raise an incident or exception — the fields make it land assessable, not as a paragraph in an inbox.

  • Category *pick listincident, exception, review
  • Severity *pick listdrives the deadline
  • Identified ondatethe clock starts here
  • Risk ownerpersonaccountable, visibly
  • Evidenceattachmentattached as it happens, not at audit time
  • Risk officer sign-offapproval stageclosure needs approval, on the record
Remediate2 of 4 steps
Root cause recorded
Treatment actions completed each action a tick on the record
Evidence attached
Controls re-tested
Complete Remediate → hand off to Closed

the Complete button only exists once every step is ticked

fig. 4 — what machtask handlesconfigured for this process

  • Change the process once, everywhere

    Versioned process

    When the regulation changes, publish once — every team follows the new rules from the next request, and old work is retained with its process version.

  • Approvals with names and timestamps

    Sign-offs

    Approval stages are part of the process, not an email thread — who approved, when, and against which version.

  • Slippage raises its own alarm

    Deadline alerts

    Severity sets the clock; a remediation going overdue raises an email alert automatically.

  • The register as a live surface

    Watch Tower

    The risk officer's board: open items by team, what is aging, what breaches soon — not a spreadsheet tab.

fig. 5 — what improvesfor the team running the work

  • Reviews cannot silently slip

    Every review is a request with an owner and a deadline — late is visible, not discovered.

  • Evidence is a by-product

    The work is the audit trail: steps, sign-offs and timestamps recorded as they happen.

  • Execution beneath the register

    Incidents, exceptions and remediation obligations become owned, evidenced work — the register stays the source of intent.

Configure your own categories, severities, remediation steps and sign-off stages. Published changes are versioned.

Run one real process in machtask.

Start with the process your team currently runs through an inbox, spreadsheet or SOP. The three-month pilot is free.

.machtask.app

3–30 characters · no card · 3-month pilot