Parapet Integrated Risk Management

Risk information is more useful when it connects

Parapet is configurable Integrated Risk Management software, developed and owned by Hot Desk in New Zealand. We have been building it since 2016 to support enterprise risk, IT risk, third-party risk, governance, compliance, audit, assurance, business continuity and remediation.

The difference between an isolated register and an integrated environment is the relationship between the records. In Parapet, a team can see which obligation a control supports, which risk is affected by an assurance finding, who owns the response and what action is overdue.

Most organisations start by looking for better registers and reporting. The harder question is whether risks, controls, assurance, continuity and remediation can work together without forcing every team into the same process.

What teams can do in Parapet

• Identify, assess, prioritise and monitor risks across different risk domains
• Connect obligations, controls, assurance findings, actions and owners
• Assign work with due dates, reminders, notifications and escalation
• Use dashboards, reports, trends, heatmaps and other risk and compliance views
• Configure workflows and information structures around the organisation

Built to work with an existing environment

Parapet includes more than 300 configuration pages, including options for connecting it with other systems. We have integrated it with Azure, AWS, ServiceNow CMDB and SAP environments. Each client receives an OpenAPI 3.2 definition so approved teams can use the platform programmatically.

Existing risk registers can be migrated by spreadsheet import, API bulk loading or selected database migration. The right approach depends on the condition of the source data, the relationships that need to be preserved and the organisation's assurance requirements.

Hosting and scale

Parapet is available as a hosted SaaS service or in a customer-controlled environment, including customer data centres and customer-owned Azure or AWS environments. The front end, database and stateless API/middle tier are separated, and multiple middle-tier instances can run behind a load balancer.

A Parapet deployment in the banking sector is used by approximately 30,000 people. Concurrency and performance requirements are assessed for each client's own workload, so this should not be read as a general benchmark.

Getting started

A standard implementation usually takes three to four weeks when the scope, data and stakeholder availability suit that approach. More complex migration, integration or assurance work takes longer. Configuration, implementation support and train-the-trainer enablement are normally included.

Talk to us about Integrated Risk Management or visit the Parapet website.