Why RiskQuilt exists
The problem we saw
Growing organisations reach a point where they know they need structured risk management. Their boards are asking for it. Their auditors expect it. Their insurers are starting to require it.
But the tools available don't fit. Enterprise GRC platforms cost tens of thousands, take months to implement, and are designed for full-time GRC specialists. Niche tools only cover one domain. So organisations default to spreadsheets — and spreadsheets stop working the moment more than one person needs to contribute.
RiskQuilt was built to fill that gap: a risk operating platform that's structured enough to satisfy governance requirements and guided enough that the people who actually manage risk will use it every day.
Who's behind RiskQuilt
RiskQuilt is built by Tom Whipp. Tom has spent over two decades in cyber and technology risk across regulated financial services and insurance — most recently as Director of Technology Risk at a large regulated UK insurer, where for around seven years he regularly attended the risk committee — cyber was the top risk for most of that period — engaged directly with the PRA and FCA, and provided second-line oversight of a £100M+ cyber programme. Before that, as a group CISO, he built security and second-line risk functions from a standing start.
That experience is what RiskQuilt is made of. The frustrations it answers — registers that go stale, controls that are expensive to prove, tools bought for the reporting layer and ignored by the people who actually own the risk — aren't hypotheses. They're the day job, seen from the inside.
Founder-led means every customer gets direct access to the person making the product decisions — someone who has been in the room for the risk committee, faced the regulator, and prepared for the audit.
How we build
We have opinions about how risk management software should work. We've written them down.
Adoption is the design constraint
Every feature earns its place by making risk management easier for the people who do it.
Boring technology
We use proven, well-understood tools. No bleeding edge, no vendor lock-in.
Security is the default
Tenant isolation, externalised authentication, and append-only audit logs — not added later, built in from the start.
Transparent pricing
Published at every plan. No "contact sales" walls.