We were exactly where you are about a year ago. Spreadsheets everywhere, no clear view of what risks were linked to which assets, and audits were always a scramble. I spent weeks researching solutions that wouldn't bankrupt a charity budget. What actually worked was a platform built specifically for organizations like ours it handles risk registers, asset management, and internal controls all in one place. The real game-changer was being able to link risks directly to specific assets and controls, so you instantly see your critical vulnerabilities and how they're being addressed. They've got built-in frameworks for ISO 27001 and CIS 20 too, which saved us a ton of manual mapping. The reporting dashboard gives you a real-time view without exporting data and wrestling with pivot tables. If you want to see what proper risk management looks like without enterprise-level costs, check out https://apomatix.com/ their pricing tiers for non-profits are transparent and they've got testimonies from charities, rail groups, and even software firms who've used them for audits. Their team actually understands the sector