Assessment: Mittenda Limited IE · Regulation: EU 2023/1113 · Roles: PSP, Intermediary PSP, CASP, Intermediary CASP
Assessment
ISO 31000:2018 §6.1 — Risk management process — what this requires
ISO 31000:2018 §6.1 — Risk management process
Although the risk management process is often presented as sequential, in practice it is iterative. The process involves communication and consultation; establishing the scope, context and criteria; and assessing, treating, monitoring, reviewing, recording and reporting risk.
How this app differs from ISO 31000
ISO 31000 says that the process is often shown as a sequence, but that in practice it is iterative. This app puts the six stages in a fixed order, with a sign-off at the end of each stage, so that each decision has a record. That order is our choice, not a requirement of the standard. You can reopen a stage after its sign-off.
The standard does set one order. Risk evaluation compares the results of risk analysis with your risk criteria, so you analyse a risk before you evaluate it.
Each stage card shows the line of defence that usually owns the stage: 1L is the first line, 2L the second. The label does not stop anyone else working on the stage. ISO 31000 also says that the outcome of a risk evaluation should be validated. If the same person records and validates an evaluation, the app flags this on the management report. It does not stop the work.
Where this assessment stands, and what is left to do.
Assessment configuration
How this assessment is scoped — set when it was started; change what is editable here.
- Regulation
- EU 2023/1113 · set when the assessment was started
- Regulatory role The regulatory role determines which obligations the assessment covers.
- PSPIntermediary PSPCASPIntermediary CASP
- Period The days this assessment covers. They decide whether a dated carve-out applies, and which records a provision that has ended takes out.
- As at 19 March 2026
- Runs What this unit runs, as informational scope — not the analysis members, which are configured on the Analysis stage.
- Payment rail:No run set statedProcessing path:No run set stated
- Context
- Scope, criteria, risk appetite & stakeholders
Assessment stages
Work the stages in order — each opens its own page.Stakeholder communication and consultation
Scope, criteria, appetite, stakeholders
The risk register — identify, analyse, evaluate and treat each riskRisk-assessment phases approved: 0 of 3
Treatment-plan lifecycle + sign-off
KRIs / KCIs, treatment lifecycle, reassessment
Management report + sign-offFinal sign-off requires stages 1–5 and the three §6.4 phases approved. Not yet approved: 1 Communication & consultation (In progress); 2 Con…