Incident managementfor risk and compliance

An incident arrives as an email, a call or a message in Teams. Someone copies it into a spreadsheet, someone else works out which risks and controls it touches, and a week later the board pack describes it from memory. Nothing links to anything, so the same event is written three times, and the question that matters most, what does this put at risk, is answered last, if at all. Meanwhile a regulator's notification clock may already be running, whether or not anyone noticed.

Logging starts from wherever the event reaches you: the app, email, Teams, a QR code on the shop floor, a voice note. Describe it in plain words, or fill in the short form, and the record exists in seconds: a number, a type, an owner, a severity. In the prototype, Sheila AI builds the structured record from what you describe, so nobody starts from a blank form and nothing waits for the one person who knows how the form works.

An event rarely stays where it lands. The prototype links each one to the risks, controls and obligations it touches, and shows what moved: a control now Not effective, a risk now Above appetite, a CPS 230 requirement now Not compliant. The objectives at risk and the exposure sit on the record before anyone opens a spreadsheet, and the queue is ranked by what each event threatens, not by raw severity.

The work to put it right sits on the event with owners and dates, so nothing waits for someone to remember. Every event, from a near-miss to a confidential disclosure, lives in one register with its severity and status, and the same event is written up for the board: what happened, what it put at risk and what is being done. No one rewrites it from the queue.