landing page

Project Story

About the Project

RiskPro is an enterprise-wide operational risk management and Risk and Control Self-Assessment (RCSA) platform developed by Efiko Solutions.

It replaces fragmented spreadsheets and disconnected departmental risk registers with one governed platform where:

Departments identify and assess their risks.
Risk owners document controls, KRIs, incidents and treatment actions.
Department heads track mitigation progress and submit attestations.
The Chief Risk Officer provides centralized oversight and governance.
Executives, internal auditors and board members receive role-appropriate dashboards and reports.

RiskPro supports the complete operational risk lifecycle—from identifying a risk to monitoring its treatment and reporting enterprise exposure.

What Inspired the Project

Many organizations still manage operational risk through spreadsheets. Each department may maintain its own workbook, use different terminology and calculate risk scores differently.

This creates several problems:

Risk information becomes outdated quickly.
Consolidating reports requires significant manual effort.
Ownership and accountability are difficult to track.
Supporting evidence is scattered across email and shared folders.
Senior management cannot easily see the organization’s current risk position.
Spreadsheet changes rarely provide a reliable audit trail.

RiskPro was inspired by the need to make enterprise risk management continuous, collaborative and defensible.

The guiding idea was simple:

Risk should remain with the departments that understand it, while governance, methodology and enterprise oversight remain centralized under the CRO.

How RiskPro Was Built

RiskPro was built as a production web application using:

Laravel for the backend and business rules
Vue 3 and TypeScript for the user interface
Inertia.js for communication between Laravel and Vue
Tailwind CSS and reusable UI components
MySQL for persistent storage
Vite for optimized production assets
PHPUnit for automated backend testing
Chromium and Playwright for browser-based interface verification

The architecture uses tenant isolation and role-based permissions. Each user receives access according to their organizational scope and responsibilities.

Supported roles include:

Platform Administrator
Chief Risk Officer
Risk Analyst
Division Head
Department Owner
Risk Champion
Risk Contributor
Action Owner
Executive
Internal Audit
Board Viewer

Core Risk Workflow

Departments can build and maintain their own risk registers while the CRO receives an enterprise-wide view.

A standard risk score is calculated as:

$$ \text{Risk Score} = \text{Likelihood} \times \text{Impact} $$

RiskPro records both inherent and residual exposure:

$$ R_{\text{inherent}} = L_{\text{inherent}} \times I_{\text{inherent}} $$

$$ R_{\text{residual}} = L_{\text{residual}} \times I_{\text{residual}} $$

The platform compares residual exposure with the approved risk-appetite threshold:

$$ \text{Appetite Status} = \begin{cases} \text{Exceeds}, & R_{\text{residual}} > T \ \text{Approaching}, & 0.8T \leq R_{\text{residual}} \leq T \ \text{Within}, & R_{\text{residual}} < 0.8T \end{cases} $$

where (T) is the applicable appetite threshold.

Each reassessment is retained as a timestamped record rather than silently replacing the previous assessment.

Major Features

RiskPro includes:

Departmental and enterprise risk registers
Configurable risk categories and departmental subcategories
Versioned risk-assessment frameworks
Inherent and residual risk scoring
Risk-appetite monitoring
Interactive heat maps
Control design and effectiveness assessments
Treatment actions and progress tracking
Key Risk Indicators and threshold monitoring
Operational loss-event reporting
Evidence and attachment management
Departmental attestations
Second-line challenges
Risk-acceptance approvals
Governance and remediation issues
Notifications and escalation indicators
Enterprise analytics and drill-down reporting
Excel, CSV and PDF exports
Branded board packs
Custom and scheduled reports
User invitations and role administration
Multi-factor authentication
Optional single sign-on support
Data-import templates and validation
Role-specific illustrated Help Center
Light and dark themes
Mobile-responsive interfaces

Challenges Faced

Translating spreadsheets into governed workflows

Spreadsheets are flexible, but that flexibility often hides inconsistent processes. The challenge was converting familiar spreadsheet activities into structured workflows without making the application feel restrictive.

We addressed this through configurable categories, custom fields, flexible filters and department-created subcategories.

Balancing Local Ownership With Centralized Oversight

Department users need control over their own registers, while the CRO needs enterprise-wide visibility.

RiskPro handles this through organizational scoping. Every record belongs to an organization and a specific business unit. Department users can access records belonging to their assigned units, while the CRO can review the complete enterprise portfolio.

This preserves departmental ownership without exposing unrelated records or compromising centralized oversight.

Designing Permissions That Reflect Governance Responsibilities

Not every visible action should be available to every user. For example, a department can request risk acceptance, but the CRO must approve or reject it.

One major lesson was that authorization must be enforced in two places:

On the server, to protect the operation.
In the interface, to avoid presenting controls the user cannot use.

Producing Reliable Reports on Shared Hosting

The production server did not provide Node.js, so frontend assets could not be built during deployment.

The solution was to build optimized assets before deployment and commit the compiled output. Production deployment therefore requires only Git and PHP commands.

Supporting Dark Mode Across Legacy Page Styles

Some screens originally used explicit light backgrounds and text colours. These became unreadable under dark mode.

A scoped compatibility layer was introduced for authenticated pages, while public and authentication screens retained their intended visual design.

Creating Useful Documentation

Enterprise platforms can overwhelm new users if documentation is separated from the application.

RiskPro includes a public, role-specific Help Center with real screenshots, smooth article navigation, theme support and clean PDF printing. Signed-in users automatically see the guide for their assigned role but can browse other tracks.

What We Learned

Building RiskPro reinforced several important lessons.

Good Risk Software Must Support Accountability

A risk register is not merely a list. Every risk needs ownership, assessment history, controls, actions, evidence, review dates and governance decisions.

Permission Errors Are Often Interface-Design Problems

A secure 403 Forbidden response may be technically correct, but users should not be invited to perform an action they are not authorized to complete. The interface must communicate responsibility before the request is made.

Reporting Must Preserve Scope

An enterprise report and a departmental report may use the same engine, but the underlying data must always respect the viewer’s organizational access.

Auditability Should Be Designed From the Beginning

RiskPro retains assessment history, report runs and governance decisions. Important changes are recorded with timestamps and responsible users, creating a defensible history.

Documentation Is Part of the Product

The Help Center is not an afterthought. It helps each role understand both how to use RiskPro and where its authority begins and ends.

The Result

RiskPro transforms operational risk management from periodic spreadsheet consolidation into a live enterprise process.

Departments retain ownership of their risks. The CRO gains centralized governance and visibility. Executives and the board receive current, decision-ready information.

Most importantly, the organization gains a single source of truth for operational risk—one that is structured, auditable and designed to support action.