Residual: Audit Ready Risk Register for Jira
Project risk register your auditor will accept. Set up by the project admin in five minutes, nothing added to your Jira schema.
Residual is a project risk register for Jira Cloud built for PMOs and quality teams in regulated environments. Assess inherent and residual risk with reasoning, track treatments with evidence, and export an audit ready report.
No Jira admin needed
Your project admin turns Residual on and configures it. No new work item type, no custom fields, no permission scheme changes, no ticket to IT. The register lives in the project, the Jira schema stays untouched.
Register with heatmap at the top, risk table below and the Create risk button
Every rating carries its reasoning
Inherent and residual risk are assessed separately and stored separately. Each assessment records the rationale, the model version, the person and the time. Treatments carry owner, due date and evidence; a treatment can only be marked effective when evidence is attached.
Detail panel with inherent and residual assessment, each with rationale, model version, person and time
An audit trail an auditor can read
Every change is recorded with the person who made it, the old value and the new value. Nothing is written in the name of the app. The PDF report contains the register, both heatmaps, every assessment with its reasoning and the full history, ready to hand over.
Treatments tab with three treatments, one marked Effective with evidence
History tab with changes recorded under the name of the person, next to the first page of the PDF report
Who it is for
Residual is for project managers, PMO leads and quality managers who run projects and programmes in environments where a risk register has to stand up to an audit: regulated industries, public tenders, contract deliveries with formal risk reporting. If you keep your project risks in a spreadsheet next to Jira because the tools inside Jira do not satisfy your auditor, Residual is built for you.
What it does
Residual adds a Risks page to any Jira Cloud project. Risks are assessed on a fixed five by five model of probability and impact, with an optional third dimension for detection. Inherent and residual risk are assessed separately and never derived from each other. Every assessment requires a written rationale and stores the model version, the person and the time. Treatments are tracked with owner, due date, status and evidence of effectiveness. Every change to a risk, an assessment or a treatment is written to an audit trail under the name of the person who made it.
The register is configured by the project admin. Labels and descriptions of the scales can be adapted per project. Residual does not create work item types or custom fields and does not require Jira administrator rights at any point.
The PDF report exports the full register: summary by risk level, both heatmaps, the risk table, and for each risk its assessments with reasoning, its treatments with evidence and its history. A CSV export is available for further analysis.
Residual runs entirely on Atlassian infrastructure. No data leaves your Atlassian cloud.
What it is not
Residual is not an information security management system and not a GRC tool. It does not map controls to frameworks and it does not manage an asset inventory. It does not turn risks into work items on your boards. It is a register for project and programme risks that is ready when the auditor asks for it.
Languages
English user interface.