Risk Ledger

“We therefore treat Risk Ledger as the authoritative baseline, while retaining a route for proportionate, customer-specific follow-up.”

“A single compromise, outage or unannounced provider change can affect many organisations at once, while customers increasingly expect us to understand those fourth-party dependencies.”

“The real value is that evidence is maintained during the year instead of being recreated in the final weeks before an audit.”

“That removes some of the repetitive chasing from i2 Group and gives suppliers support from people who know the platform.”

“[It helps us] ask more consistent questions where suppliers use AI or provide AI-enabled services—covering data use, governance, human oversight and ongoing risk monitoring.”

“[Continuous Supplier] monitoring is more efficient because updated evidence is available through the connection rather than requested from scratch. It also helps us extend oversight beyond the immediate supplier to important cloud, software and fourth-party dependencies. The audit team spends less time chasing suppliers or validating document versions and more time reviewing whether controls are operating effectively.”

“For a supplier that already has a complete profile, the initial security review can fall from several hours of emails, document chasing and questionnaire analysis to roughly one to two hours of focused review—a working estimate of around 50–70% less administrative effort.”

“Risk Ledger does not remove the need for those conversations, but it means they can focus on genuine customer-specific risks rather than repeatedly collecting baseline information.”

“The feedback has generally been positive, particularly because clients can see a single, continuously maintained source rather than receive a static evidence pack that starts ageing as soon as it is sent.”

“[It gives] us a clearer route to identify and record exceptions rather than treating assurance as pass or fail.”

“Keeping clear ownership with Security, but drawing on named evidence owners, helps us keep the profile current without turning every request into a large cross-business exercise.”

“Previously, obtaining assurance depended on each supplier’s willingness to complete our spreadsheet or send a security pack, and the resulting documents then had to be reviewed, stored and revisited manually.”

“Assurance is also happening earlier and is becoming a continuing obligation rather than a one-off procurement check.”

“While we currently primarily use Risk Ledger as a supplier, we are actively exploring the potential of leveraging it to assess our own suppliers. This dual-use approach could provide a more holistic view of our security ecosystem and further streamline our risk management processes.”

“The Supplier Q&As and help sections have proven to be extremely useful, particularly when onboarding new team members or addressing unique customer inquiries. They serve as an excellent reference point for common questions and best practices in the industry.”

“Risk Ledger has significantly improved the efficiency of our customer assessment processes. It has enabled us to standardise our approach across various customer requirements and substantially reduced the time spent on redundant questionnaires.”

“Your assessment sections cover a wide range of domains and are sufficiently comprehensive to build and maintain customer trust.”

“We've observed that a significant number of clients accept our Risk Ledger profile without requiring additional assessments. This has been instrumental in expediting the sales process for deals with large customers.”

“The standout features for us are the ease of sharing our security profile with both existing Zendesk customers and prospects. The UI/UX is exceptionally user-friendly, and the Action Centre provides convenient access to connection and remediation requests. We haven't encountered any significant shortcomings to date; in fact the platform has only gotten better over time.”

“Our experience with Risk Ledger has been overwhelmingly positive…I've found Risk Ledger to be an invaluable platform in streamlining our subscribers' approach to third-party risk management and helping us build and maintain customer trust.”

“The reason we want all our tenders to go through Risk Ledger is because once a supplier goes through a tender, then they be required to go through our assurance process in any case, so we thought by initially putting them through the process, it would save time for them and for us reviewing them.”

“It makes our conversations with everybody a lot easier. Your assessment framework allows us to argue this is the standard how you do supply chain risk management. This is across the enterprise, not just cloud security. So it allows us to argue this is not us doing this. This is how it should be done.”

“I like the fact that the platform is searchable and that information is easy to retrieve. For me, it's also the individual policies that we can apply to our services, and they are so flexible for us. That is probably the key feature. It's about the fact that policies are specific to what we need them to be, and it's easy. The tagging, the labelling and the meta information is also really good.”

“Since we signed up for Risk Ledger, we have included supply chain compliance within our security scorecards. Including this information allows our board and risk groups to quickly assess any risks within our supply chain and to take appropriate action should a supplier not be meeting our security requirements.”

“we can now easily dive into the risk areas. Even though the team still reviews every single question just in case they answered it wrong, it’s still much faster. We can easily pinpoint the areas that are at risk and focus on these”