Pelican · quantitative risk registerRisk register software that adds up your risks
Pelican is a risk register your team will recognise, with owners, controls, reminders and a full history. The difference is that every risk carries a number as well as a colour. So Pelican can add your risks up, compare the total with your risk appetite and show which controls pay for themselves.
Last updated October 2026
What it is for
What is Pelican for?
A risk register lists the risks an organisation faces, who owns each one and what is being done about it. Most registers score each risk and colour it on a heat map. Scores can rank risks, but they cannot be added up, so they cannot answer the questions a board asks:
How much could we lose this year?
Pelican simulates thousands of possible years and adds every risk up, so you see the expected loss and the bad years.
Are we inside our risk appetite?
Compare the total with the risk appetite of each entity, project or the whole organisation, and see the chance of going over it.
Which risks matter most?
Rank risks by what they could cost, in money or in safety, environment, ESG or service, instead of by a score.
Which controls pay for themselves?
Compare what each control costs with the exposure it removes, and put the risk budget where it works.
Try it: same colour, different risk
Ten example risks of a fictional manufacturer. Amounts are illustrative.
What the heat map tells the board
- 81 Supplier fails · 2 Top customer leaves · 10 Batch scrapped
- 64 Ransomware · 6 Lost-time injury · 7 Permit breach · 8 ERP outage · 9 Key engineer leaves
- 53 Plant fire
- 45 Product recall
Three risks tie for the top score. The plant fire scores 5, ranks ninth of ten and is coloured green.
The small box is each risk’s heat-map score.
Same colour, eight times the expected loss: the customer risk and the supplier risk share a cell. And the fire that the heat map ranks ninth decides the worst year in a hundred.
The problem with scores
Why a heat map cannot add up your risks
A heat-map score is a ranking, not an amount. Two risks with the same score can be very different in size, and scores cannot be added. So a qualitative register has no total to compare with what the organisation can afford to lose.
- Same cell, different risk. Supplier failure has a 6% chance a year and would most likely cost €1.2m. Losing the largest customer has an 18% chance and would most likely cost €4.0m. Both score 8, yet the second costs €765k a year on average, against €92k.
- Low score, worst year. The plant fire scores 5 because it is unlikely. In the worst year in 100, it causes 84% of the loss.
- No total. Ten scores do not add up to anything. Ten quantified risks do, as the figures here show.
That last figure is the one a board can act on. Move the appetite line in the example to see it change.
How Pelican works
What can Pelican do?
Pelican keeps everything a risk register already does. It adds a chance and an impact range to each risk, and the simulation that turns them into a total. Each feature below is shown on real Pelican screens.
The register
One register the whole organisation can use
Pelican keeps every risk in one place, from a single project to the whole organisation, with an owner and a plan for each.
- Anyone can submit a possible risk for assessment. The risk owner and the risk team take it from there.
- Enter risks one at a time, or many at once in bulk data entry tables.
- Assign treatment tasks to people. Pelican connects to their calendar and reminds them in good time.
- Each person has a profile page with the risk tasks they need to complete.
- Build a hierarchy of entities down to any level, from the group to a single site or project.
- Risk submissions
- Bulk entry
- Calendar reminders
- PC, tablet or phone
Quantified risks
Every risk gets a number, in more than money
Owners give the chance of the event and its impact as a range: minimum, most likely and maximum. That is no harder than picking a score, and it uses what they actually know.
- Impacts beyond money: safety, environment, ESG measures, service availability or any other key performance metric.
- Impact scales set for each entity, for example by its financial capacity.
- Global definitions of each impact, matched to your organisation’s own policies.
- The heat map stays, drawn from the numbers: each risk sits at its real frequency and magnitude, with the effect of its controls.
- Financial
- Health and safety
- Environment
- ESG
- Reputation
- Service
Bowtie analysis
See how each risk can happen, and what stops it
Each risk gets an interconnected bowtie: the causes on one side, the consequences on the other, and the controls in between, each with its numbers.
- Add controls that stop a risk happening, and mitigations that reduce the chance or size of its consequences.
- Use the bowtie editor to brainstorm with the people who know the risk.
- Link risks to other risks to describe cascading effects.
- Share drivers and consequences across risks, so the natural links between them are kept.
- Interconnected risk maps show the whole causal chain automatically.
Aggregation
Add the risks up and compare them with your risk appetite
Pelican runs a Monte Carlo simulation of thousands of possible years and adds the risks up by entity, region, product or impact type. It then compares the total with your risk tolerance.
- A risk appetite set for each business entity or project.
- Top financial risks ranked by their value at risk, not by a score.
- The capital to hold for financial losses, at the level of confidence you choose.
- Key risk indicators to track emerging trends in your exposure.
- Risk profiles compared across entities, projects and regions.
- Monte Carlo
- Risk tolerance
- Value at risk
- Capital
Cost-effective treatment
Spend on the controls that pay for themselves
Pelican compares what each control or mitigation costs with the exposure it removes, across every impact type and including cascading risks.
- Scenario analysis finds the most cost-effective way to manage a risk: which barriers to implement or retire, the budget needed and the exposure saved.
- Tools to find the weak points in your overall risk treatment.
- Insurance cover parameters optimised, to save on premiums.
In the example: which controls pay for themselves
For the example manufacturer, five possible treatments, each compared on what it costs against what it saves in expected loss:
| Treatment | Cost a year | Saves a year | Saving per euro |
|---|---|---|---|
| Key-account programme for the largest customer | €60k | €255k | 4.3 |
| Offline backups and phishing training | €35k | €78k | 2.2 |
| Sprinklers in the paint shop | €40k | €80k, and halves the cost of a fire | 2.0 |
| Second qualified supplier | €70k | €61k | 0.9 |
| Extra in-line inspection | €50k | €21k | 0.4 |
The first three pay for themselves, and the last two do not, on these numbers. Together the first three cost €135k a year. They cut the expected loss from €1.5m to €1.1m a year, and the chance of a year worse than €3m from 19.6% to 13.9%.
Responsibility
Know who and what your risk management depends on
A control only works if someone looks after it. Pelican shows how much rests on each person and on each third party.
- See which people are most relied on for managing risks, and spread the responsibility for greater resilience.
- An overview of the owners of risks, their controls and their consequences.
- Automated analysis of how much your risk management depends on third parties.
Deep analysis
Go deeper on any single risk, including cyber
For the risks that matter most, Pelican gives a detailed analysis of the single risk: its drivers, its controls and its financial impact.
- Drivers and controls in one view, with what each contributes.
- Managed, unmanaged and potential exposure side by side.
- A FAIR-style analysis for cyber risks, so resources go where they reduce cyber risk most.
Reporting and audit
Reports, dashboards and a full history
Everyone from the board to the auditor gets the view they need, and every change is recorded.
- A library of ready-made report templates: a new report in a couple of clicks.
- Design your own report templates with drag and drop, or edit and duplicate existing ones.
- Key performance indicators of any design for each entity.
- An automatic log of every change to risk data, with files and comments attached.
- Drill down and search for any risk, any treatment action and any person’s tasks.
- Supports compliance with ISO 31000, the COSO ERM framework, BS 31100, the OCEG Red Book and FERMA.
Free download
Free risk register template (Excel)
Start with numbers today, in a spreadsheet. The template is a working quantitative risk register in plain Excel, with no add-in and no macros. It comes filled in with the ten example risks from this page, so you can see every number above come out of it.
- A register with owners, causes, consequences, controls and treatments.
- For each risk, a chance a year and an impact range, from which it works out the expected loss.
- The heat-map score, computed from your numbers, so the board keeps its familiar picture.
- A Monte Carlo sheet that plays out 2,000 years and adds the risks up against your risk appetite.
- A treatment test: cost, saving a year and saving per euro, with a switch to see what treatments do to the bad years.
When a spreadsheet stops being enough (several editors, reminders, an audit trail, totals across sites), Pelican keeps the same approach with the workflow around it.
- Read meHow to use it in six steps.
- RegisterUp to 25 risks: owner, cause, consequence, controls, chance and impact range.
- ResultsExpected total, the 1-in-5, 1-in-20 and 1-in-100 years, and the chance above your appetite.
- Heat mapThe familiar picture, scored from your numbers.
- Simulation2,000 simulated years. Press F9 for a new run.
- ScalesYour own score bands for the heat map.
Connections
Works with ModelRisk, Tamara and your other systems
The same risks feed the models and the decisions, and the results go back to the register.
Tamara
Tamara reads risks and mitigations from the Pelican register for cost and schedule risk analysis, and sends each milestone’s likely cost and date back to Pelican’s dashboards. About Tamara
ModelRisk
ModelRisk reads risk data from Pelican, sends results back, and runs ModelRisk models for a whole team inside the platform. About ModelRisk
Pelican IRM
Pelican IRM brings together the quantified results from ModelRisk, Tamara and the risk register, so leadership sees total exposure against its risk appetite. About Pelican IRM
GRC systems
Pelican is not a governance, risk and compliance (GRC) system. It can import a GRC system’s risk evaluations, when they are quantitative, into the wider picture. A version of Pelican, Archer Insight Workbench, gives clients of Archer Insight the Pelican tools on their Archer data.
Where Pelican runs: as a cloud service in any modern browser, or installed on your own network with Windows Server, IIS and Microsoft SQL Server. Security and data protection
By industry
Explore Pelican for your industry
Where a quantitative risk register fits in your industry, the risks it holds and the products that work alongside Pelican, in your industry’s own terms.
Full feature list
Everything in Pelican
The full list of the Pelican risk register. Pelican IRM adds the view for leadership on top. Download the Pelican brochure (PDF, 0.7 MB) ↓Download the one-page overview (PDF, 0.3 MB) ↓
Pelican clients include
Pricing
What does Pelican cost?
These are guide prices, based on the number of Pelican users we usually see at each company size. The real cost depends on the number of users, the installation and any custom set-up. Training and consulting are priced separately.
| Company size | One-off set-up | Licence a year | Weeks to go live |
|---|---|---|---|
| Under 5,000 employees | €20k–40k | €40k–60k | 2–4 |
| 5,000 to 20,000 employees | €30k–60k | €80k–150k | 2–6 |
| 20,000 to 100,000 employees | €40k–80k | €100k–200k | 4–8 |
| Over 100,000 employees | €60k–100k | €150k–300k | 6–10 |
Organisations where more staff do manual work, or that face fewer regulations or lower risk, have fewer Pelican users for their size, and the other way round.
Buyer’s checklist
How to choose risk register software: seven questions
Use these in any vendor demo, including ours.
- Can a risk carry a chance and an impact range, or only a score?
- Can it add risks up across business units and compare the total with a risk appetite?
- Does it handle impacts other than money, such as safety, environment or service, without forcing them into one score?
- Can you see what a control costs against what it saves?
- Do owners get reminders, and does every change leave a log?
- Can people outside the risk team submit a risk easily?
- Can you get your data out, as exports and reports, without the vendor’s help?
FAQ
Questions about Pelican and risk register software
What is risk register software?
Software that holds an organisation’s list of risks, with owners, controls, treatment tasks and reviews, so the register can be shared, kept current and reported on. Quantitative risk register software, such as Pelican, also puts a number on each risk, so the risks can be added up.
What is a quantitative risk register?
A register in which each risk has a chance and an impact range instead of only a score, so the risks can be simulated and added up. It answers “how much could we lose this year, and how likely is that?”, which a heat map cannot.
Can I keep a risk register in Excel?
Yes, and many organisations start there. Our free template is a quantitative register in plain Excel. Move to software when several people edit the register, owners need reminders, auditors need a history, or you need totals across sites.
Do we have to give up our heat map?
No. Pelican draws the heat map from the numbers, so the familiar picture stays, but each position now has an amount behind it.
Is Pelican ERM software?
Pelican starts as a risk register and grows into enterprise risk management. It has a hierarchy of entities, a risk appetite for each entity, key risk indicators and dashboards, and it supports ISO 31000 and COSO ERM. Pelican IRM adds the view for leadership.
Does Pelican run in the cloud or on our own servers?
Either. Use Pelican as a cloud service in any modern browser, or install it on your own network with Windows Server, IIS and Microsoft SQL Server. The security page has the details.
Does Pelican work with ModelRisk and Tamara?
Yes. Tamara reads risks and mitigations from Pelican and sends each milestone’s likely cost and date back to its dashboards. ModelRisk reads risk data from Pelican and sends results back.
How much does Pelican cost?
Indicative prices run from €20k–40k for set-up and €40k–60k a year for companies under 5,000 employees, to €60k–100k for set-up and €150k–300k a year above 100,000 employees. The price table on this page has the bands in between.
How do I see Pelican?
Pelican is a web platform set up for each organisation, so it starts with a presentation on your kind of risks. Request an online presentation and a consultant will prepare for it.
See your own register in numbers
Pelican is set up for each organisation, so it starts with a presentation on your kind of risks. Or start today with the free template.