INTELLIGENT DECISIONING LTD

Risk Register

The Intelligent Decisioning Risk Register application helps organisations systematically identify, assess, and manage risks. It centralises risk analysis, evaluation, and treatment processes, ensuring compliance with ISO standards and enabling informed decision-making to protect assets, maintain security, and support continuous improvement of governance frameworks.

Features

• Centralized risk repository for consistent tracking across all projects
• Real-time risk scoring and prioritisation using configurable algorithms.
• Role-based access control ensuring secure and compliant user permissions
• Dynamic dashboards with interactive charts for instant risk visualisation
• Automated notifications and alerts for high-risk threshold breaches
• Integration with Microsoft Dataverse for seamless data synchronization and storage
• Advanced filtering and search capabilities for quick risk identification
• Audit trail logging for complete transparency and compliance reporting
• Customisable workflows for risk mitigation and escalation processes
• Exportable reports in multiple formats for stakeholder communication and analysis

Benefits

• Quickly identify and assess risks to prevent project delays
• Streamline risk management processes for improved operational efficiency
• Enable proactive decision-making with real-time risk visibility dashboards
• Reduce compliance gaps by automating ISO-aligned risk documentation workflows
• Enhance collaboration through centralised risk data accessible to all teams
• Accelerate reporting with instant exportable summaries for stakeholders and auditors
• Improve accountability using detailed audit trails for every risk action
• Minimize business impact by triggering timely alerts for critical risks
• Customise workflows to align risk mitigation with organisational priorities.
• Empower leadership with actionable insights for strategic risk planning decisions

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@id-live.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

810346503105792

Contact

Tony Pounder
07967 320622
info@id-live.com

About your service

• Service categories:

  Applications

  Content workflow and management

  • Capture
  • Document

  Content services

  • Enterprise Content Management Applications

  Persuasive content management

  • Digital Adoption Platform

  Enterprise portals and digital workspaces

  • Integrated Employee Workspaces
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: Microsoft 365, Microsoft SharePoint Online and Microsoft Teams
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: The Intelligent Decisioning Risk Register requires a Microsoft 365 license and Power Platform environment. It supports modern browsers only and needs an active internet connection; offline access is unavailable. Performance depends on Dataverse capacity and API limits. Planned maintenance may cause short service interruptions, communicated in advance. Customisations beyond standard configuration may require additional development resources. Integration with third-party systems is limited to approved connectors or APIs. Data residency follows Microsoft cloud regions, and high-volume environments may need premium capacity for optimal performance.
• System requirements:
  • Active Microsoft 365 subscription with Power Platform environment provisioned.
  • Dataverse database configured for secure data storage and management
  • Modern web browser: Microsoft Edge, Chrome, or Firefox supported
  • Stable internet connection; offline functionality is not currently supported
  • Azure Active Directory for authentication and role-based access control

User support

• Email or online ticketing support: Yes
• Support response times: UK office hours - 08:00 - 18:00 Low Priority Response Time: 4 hours Resolution Time: 30 days Medium Priority Usually applied to single-function errors; resolution within agreed timeframe (often under 15 days). High / Urgent Priority Major incidents or critical business impact; response within hours, resolution expedited (often same day or within 1–2 days)
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AAA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AAA
• Web chat accessibility testing: The service provider has carried out web chat testing
• Onsite support: Yes, at extra cost
• Support levels: Intelligent Decisioning provides retained consultancy and managed support services under a personalised SLA, with the costs being on a day rate basis of £900 per day. Support covers Incident Management, Problem Management, and Request Management, with unlimited ticket logging via a self-service portal and monthly usage reporting. Standard hours are Monday–Friday, 08:00–18:00 UTC, excluding holidays. Customers receive a dedicated principal contact and access to Microsoft 365 experts for SharePoint, Power Platform, and related technologies.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: We provide multiple options to ensure a smooth start with the Intelligent Decisioning Risk Register:; ; Online Training: Interactive sessions via Microsoft Teams covering setup, configuration, and best practices.; Onsite Training: Available for enterprise deployments requiring hands-on workshops for key stakeholders.; User Documentation: Comprehensive guides, FAQs, and step-by-step tutorials accessible through our support portal.; Video Tutorials: Short, focused videos for common tasks and advanced features.; Dedicated Support: Initial onboarding assistance from our technical team, including environment setup and integration checks.; Knowledge Base: Articles and troubleshooting tips for self-service learning and quick issue resolution.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: When the contract ends, users retain full control of their data. All risk records, attachments, and related metadata can be exported using Microsoft Dataverse’s standard tools, including Excel or CSV export. For large datasets, Power Platform’s Bulk Data Export service allows transfer to Azure Data Lake or Blob Storage for secure archiving. Users can also use the Dataverse Web API to retrieve structured data programmatically before service termination. Comprehensive reports can be generated and downloaded in PDF or Excel formats for offline storage. Intelligent Decisioning does not retain customer data after contract closure. Our support team provides guidance during offboarding to ensure complete, secure, and compliant data extraction.
• End-of-contract process: End of Contract; At the end of the contract, users retain full ownership of their data. They can export all records, attachments, and metadata using Dataverse tools, Bulk Data Export, or API access. Intelligent Decisioning does not store customer data post-contract and provides offboarding support to ensure secure extraction.; Included in Price; The contract includes access to the Risk Register application, standard configuration, user documentation, and online training sessions. It also covers routine updates, security patches, and standard business-hours support.; Additional Costs; Optional services such as onsite training, custom development, advanced integrations, premium Power Platform capacity, and extended support outside business hours incur additional charges. Data migration assistance beyond standard export and bespoke reporting or analytics are also billed separately.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service is fully responsive so the differences are down to the order in which the screen are displayed - the content is stacked for a mobile device
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The Intelligent Decisioning Risk Register provides a secure, web-based interface accessible through modern browsers. Users interact via intuitive dashboards for risk entry, scoring, and visualization. Role-based menus ensure authorized access to risk data and workflows. The interface supports real-time updates, advanced filtering, and export options for reports. Integration with Microsoft Dataverse enables seamless data synchronisation, while embedded notifications and alerts keep users informed. Customizable views and responsive design ensure usability across desktop and mobile devices, delivering a streamlined experience for managing organisational risks efficiently.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Intelligent Decisioning conducts accessibility testing to ensure docCentrum meets WCAG 2.1 AA standards and PSBAR compliance. Testing includes user sessions with customers who have assistive technologies such as screen readers (JAWS, NVDA), keyboard-only navigation, and high-contrast modes. We validate that all interactive elements are operable without a mouse, content is perceivable, and navigation is logical for users relying on assistive tools. During UAT, selected participants tested workflows for mandatory reads, document search, and compliance tasks using screen readers and voice navigation. Issues identified—such as missing ARIA labels or inconsistent focus order—were remediated before release. Continuous improvement is embedded in our process, with periodic audits and feedback loops to maintain compatibility with evolving assistive technologies. This ensures inclusivity and usability for all users, regardless of ability.
• API: Yes
• What users can and can't do using the API: Set up via API; ; Provision configuration records (settings, categories, workflows) in Dataverse using Web API.; Authenticate with Microsoft Entra ID (OAuth 2.0) using user tokens or service principals.; Register environment variables, connections, and feature flags through Dataverse configuration tables.; Seed initial data (risk types, owners, severities) with bulk/batch requests.; ; Make changes via API; ; Perform CRUD on risks, actions, mitigations, reviews, attachments, and tags.; Update status, scores, and ownership; trigger real‑time workflows/plug‑ins on change.; Query with OData $filter, $select, $expand for reporting pipelines.; Retrieve audit history and export structured data to downstream systems.; ; Limitations; ; Throttling/rate limits apply (per user/tenant); use pagination and batching.; Certain administrative operations (security roles, business rules, plug‑in registration) require admin UI or SDK tooling—not exposed as public endpoints.; Schema changes to managed solutions (tables/columns/relationships) can’t be made via public API in production; use ALM pipelines.; Transactions are bounded; cross‑entity commits may require server-side logic.; File sizes and attachment types are constrained by Dataverse limits.; Requests must respect row‑level security; API calls cannot bypass role-based permissions.; Long‑running integrations should use asynchronous patterns (queues) to avoid timeouts.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: What can be customised; Users can tailor risk categories, scoring models, workflows, dashboards, notifications, and reporting formats. They can also configure user roles, permissions, and integration points with other Microsoft 365 or third-party systems.; How users can customise; Customisation is achieved through the Power Platform interface and Dataverse configuration tables. Users can adjust settings via the Risk Register’s admin panel, create custom views and charts, and modify workflows using Power Automate. Advanced users can extend functionality with Power Apps components or add business rules and plug-ins for specific logic.; Who can customise; Administrators and users with appropriate security roles (e.g., System Administrator or Customiser) can perform these changes. Business users with delegated permissions can personalise dashboards and reports, while developers or technical teams handle advanced customisations such as API integrations or managed solution updates.

Scaling

• Independence of resources: Intelligent Decisioning ensures consistent performance by leveraging Microsoft 365’s elastic cloud architecture and Azure App Services, which automatically scale resources under load. Workflows run independently within Power Platform environments, preventing contention between users. Metadata-driven caching and throttled background tasks maintain responsiveness, while API rate limits and telemetry via Application Insights enable proactive monitoring. These measures guarantee that high demand from some users does not impact others, preserving compliance and document access across the organisation.

Analytics

• Service usage metrics: Yes
• Metrics types: The Risk Register service provides key metrics to monitor usage and performance. Metrics include the number of active risks, mitigations, and reviews; workflow completion rates; alert response times; and user activity logs. Additional insights cover dashboard engagement, export frequency, and API call volumes. These metrics help organisations track adoption, identify bottlenecks, and maintain compliance with governance standards.
• Reporting types:
  • API access
  • Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Microsoft

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: Never
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Data Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Users can export all data from the Risk Register using Microsoft Dataverse’s standard export tools, including Excel and CSV formats. For large datasets, Power Platform’s Bulk Data Export service enables secure transfer to Azure Data Lake or Blob Storage. Programmatic access is available through the Dataverse Web API for structured data retrieval. Comprehensive reports can also be generated in PDF or Excel formats for offline storage. Intelligent Decisioning provides guidance during offboarding to ensure complete and compliant data extraction
• Data export formats:
  • CSV
  • Other
• Other data export formats: JSON
• Data import formats: Other
• Other data import formats: JSON

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Intelligent Decisioning guarantees high availability for Risk Register by leveraging Microsoft 365’s resilient cloud infrastructure. Our service targets 99.9% uptime, excluding scheduled maintenance and Microsoft platform outages. Availability is monitored continuously, and performance metrics are reported through the Admin Centre and Microsoft Service Health dashboards. Service Level Agreement (SLA): Availability Commitment: 99.9% monthly uptime. Scope: Includes access to Mercury Intranet features, workflows, and compliance tasks hosted within Microsoft 365. Exclusions: Planned maintenance windows and force majeure events. Refunds and Remedies: If availability falls below the guaranteed level, customers are eligible for service credits applied against future invoices. Credits are calculated proportionally to the downtime experienced and documented in the SLA terms. For retained consultancy packages, additional support time may be offered as compensation. Our approach combines Microsoft’s enterprise-grade redundancy with Intelligent Decisioning’s governance and monitoring, ensuring minimal disruption and transparent reporting for compliance and audit purposes.
• Approach to resilience: Risk Register is built on Microsoft Power Platform and Azure, leveraging enterprise-grade resilience and redundancy. The service uses Microsoft’s globally distributed datacentres, which operate in active-active configurations across multiple geographic regions. Each data-centre includes redundant power, cooling, and network connectivity, ensuring high availability even during component failures. Data is replicated across multiple physical locations within the same region to maintain durability and continuity. SharePoint Online and Dataverse provide built-in replication and disaster recovery capabilities. Intelligent Decisioning applies governance and monitoring through Microsoft Service Health and Application Insights, enabling proactive detection and mitigation of issues. In the event of a regional outage, Microsoft’s failover mechanisms ensure continuity without user intervention. Combined with our SLA commitment of 99.9% uptime, this architecture guarantees resilience, scalability, and compliance for critical document control and governance processes.
• Outage reporting: Risk Register reports outages through multiple channels to ensure transparency and timely communication. Service health is primarily monitored via Microsoft 365 Service Health Dashboard, which is publicly accessible to administrators through the Microsoft 365 admin centre. This dashboard provides real-time status updates, incident details, and resolution progress for all underlying Microsoft services, including SharePoint Online, Dataverse, and Azure components. For automation and integration, Microsoft offers a Service Communications API, enabling programmatic access to health data for custom dashboards or alerting systems. Intelligent Decisioning can configure this API for clients requiring automated notifications. Additionally, email alerts are sent to designated administrators when incidents occur, including outage details and estimated resolution times. Optional Teams notifications can also be configured for rapid internal communication. Combined, these mechanisms ensure customers are informed promptly and can take appropriate action during service disruptions.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Intelligent Decisioning complies with ISO 27001. We enforce strict access controls across all management interfaces and support channels. Administrative access requires Multi-Factor Authentication (MFA), Conditional Access policies, and IP-based restrictions. Role-Based Access Control (RBAC) ensures least-privilege permissions, supported by dynamic group membership for efficient user lifecycle management. All administrative actions and login attempts are logged and monitored for audit purposes. Support channels are secured through identity governance, data loss prevention, and sensitivity labels. Guest access requires explicit approval and is monitored via Microsoft Purview audit tools. These measures guarantee secure, compliant access and operational resilience.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Cyber Essentials
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Intelligent Decisioning complies with ISO 27001, 9001 and the UK Government’s Cloud Security Principle 5: Operational Security. All changes follow a formal process using Azure DevOps, including risk assessment, approval, testing, and rollback plans. Emergency changes are reviewed post-implementation. Configuration baselines for Microsoft 365, Azure, and Windows are enforced via Intune and Defender. Segregation of duties, version control, and MFA prevent unauthorised changes. Compliance is maintained through audits, penetration testing, and annual reviews. Staff receive mandatory security training, and incidents trigger documented response procedures, ensuring resilience and transparency.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Intelligent Decisioning operates an ISO 27001-aligned vulnerability management process. We assess threats through regular risk assessments, automated vulnerability scans, and secure code reviews. Critical patches are deployed immediately; standard updates follow monthly or quarterly cycles after testing and rollback planning. Threat intelligence is sourced from Microsoft security bulletins, OWASP alerts, and vendor advisories to ensure timely response. Compliance is maintained through documented procedures, audits, and continuous monitoring, guaranteeing resilience and alignment with UK Government security principles
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Intelligent Decisioning uses Microsoft Defender XDR and Azure Monitor for continuous monitoring, alerting on anomalies and suspicious activity. Potential compromises are logged immediately and escalated under our ISO 27001-aligned Incident Response Policy. Critical incidents trigger immediate containment, eradication, and recovery actions, followed by root cause analysis and preventive measures. Response times are rapid—critical issues are addressed within hours, often starting mitigation within 60 minutes of detection. Regular audits, automated alerts, and documented procedures ensure resilience and compliance with UK Government security principles.
• Incident management type: Supplier-defined controls
• Incident management approach: Intelligent Decisioning operates an ISO 27001-certified Information Security Management System. Our incident management framework includes predefined processes for common events such as data breaches or service disruptions. All incidents are reported immediately by users via a standard template and escalated to the Information Security Manager for logging and response. Critical incidents trigger rapid containment and recovery actions, with SLAs ensuring urgent responses within 30 minutes. Formal incident reports, including root cause analysis and corrective actions, are provided internally and externally where required. Post-incident reviews and audits drive continuous improvement and maintain compliance with operational security principles.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • Public Services Network (PSN)
  • Joint Academic Network (JANET)
  • Scottish Wide Area Network (SWAN)
  • Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Includes all Risk Register features. Offered as a trial for up to six months.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2%
• Between £250,000 and £500,000: 3%
• Between £500,001 and £1,000,000: 4%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 6%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification
• ISO/IEC 27001 accreditation date: Friday 12 October 2018
• What the ISO/IEC 27001 doesn’t cover: The scope of the Management System applies to the following:-; THE PROVISION OF IT CONSULTANCY SERVICES AND DEVELOPMENT OF CUSTOM; SOFTWARE SOLUTIONS
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation ISO Certification
• ISO 9001 accreditation date: Friday 9 July 2021
• What the ISO 9001 doesn’t cover: The scope of the Management System applies to the following:-; The provision of IT consultancyservices and development of custom software solutionS
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 2B993ED0-97BA-43B0-BB95-93AA09B2158B
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Volunteering opportunities for staff
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@id-live.com. Tell them what format you need. It will help if you say what assistive technology you use.