Management-system registers
Management-system registers are the eight tables most management system standards expect you to keep: management systems, scope, interested parties, compliance obligations, issues, objectives, risks and opportunities, and processes. Sted drafts the first four from your onboarding answers. Administrators complete them and start the other four on the Summary page.
What this is
ISO/IEC 27001:2022, ISO 9001:2015 and ISO/IEC 42001:2023 share a structure. Before you write a single policy, each asks you to understand your context, the people with a stake in your system, its scope, its risks and its objectives. Auditors read these first, because every later decision should trace back to them.
Sted holds each of those as a register rather than a document, so a row can be owned, reviewed and linked.
| Register | What a row records | ISO 27001:2022 | ISO 9001:2015 |
|---|---|---|---|
| Management systems | A system you hold or pursue, its certification status, who is responsible, review dates | 4.4 | 4.4 |
| Scope | Scope statement, boundary, what is out of scope, products in scope | 4.3 | 4.3 |
| Interested parties | A customer, regulator, partner or other party, their needs, whether an obligation arises | 4.2 | 4.2 |
| Compliance obligations | A legal, contractual or voluntary obligation, its owner, evaluation dates | 4.2 | 4.2 |
| Issues | An internal or external issue, its impact and status | 4.1 | 4.1 |
| Objectives | An objective, its target, due date and status | 6.2 | 6.2 |
| Risks and opportunities | A risk or opportunity, its source, levels before and after controls | 6.1 | 6.1 |
| Processes | A process, its purpose, inputs, outputs and owner | 4.4 | 4.4 |
ISO 42001 uses the same clause numbers for these topics. ISO 13485:2016 predates the shared structure, so it has no context or interested-parties clause.
Where to find it
Open Summary in the group named after your organisation in the sidebar. The registers sit below the profile cards, the strips and any Statement of Applicability cards. A register appears only once it has rows.
On a phone, the sidebar sits behind the Menu button.
How it works
What Sted drafts
When onboarding finishes, Sted fills four registers from your answers: a management system for each standard you hold or pursue, a scope for each information security system, interested parties such as your customers and regulators, and your compliance obligations. Each drafted row reads “Derived from your onboarding answers” with a date until someone edits it. Sted never overwrites a row a person has edited.
Issues, objectives, risks and opportunities, and processes start empty for every organisation, because no answer can fill them honestly.
Complete a drafted row
- Open Summary.
- Find the register, for example Interested parties.
- Select Edit on the row.
- Correct or complete the fields.
- Select Save.
The drafted label disappears once you save.
Start an empty register
- Open Summary.
- Find the Management systems card.
- Select the add control for the register you want, such as Add a risk or Add an objective.
- Fill in the fields.
- Select Save.
The register then gets its own card, with its own add control. If you have no management system yet, select Add a management system first: every other register hangs off one.
Scoring a risk
A risk row asks for Likelihood before controls and Impact before controls, then the same two after controls. Each runs from very low to very high. Sted computes the inherent and residual levels from likelihood and impact, and shows the level as you pick, so nobody types a level that disagrees with their own scores. You also mark whether the risk is above your risk appetite.
Retire, never delete
Issues, objectives and risks can be retired with Retire in the edit dialog. Nothing is deleted from any register, so an auditor can see what you dropped and when.
Permissions
People have one of four levels.
| Action | Administrator | Policy and Process Owner | Reviewer | Personnel |
|---|---|---|---|---|
| Read the registers | Yes | Yes | Yes | Yes |
| Add a row | Yes | No | No | No |
| Edit a row | Yes | No | No | No |
| Retire an issue, objective or risk | Yes | No | No | No |
| Add a management system | Yes | No | No | No |
Add, Edit and Retire are drawn for administrators only, so other levels see the registers as read-only tables.
Limits and plan features
Sted drafts only what your answers support. Owners, review dates and anything onboarding did not ask about stay blank until you fill them. If a fact behind a drafted row is wrong, correct it in the conversation with Review your onboarding answers, then check the row.
A Policy and Process Owner who owns a process still needs an administrator to change its row.
Related guides
- How to run a risk assessment: scoring and treating the risks this register holds.
- Interested parties: who counts, and what an auditor expects you to record about them.
- How to run a management review: reviewing objectives, risks and issues with top management.
- Organisation summary: the page the registers live on.
- ISO 27001: the standard whose clause 4 and 6 requirements these registers answer.
Frequently asked questions
Where is the interested parties register in Sted?
On Summary, under your organisation’s name in the sidebar, below the profile cards and strips. Sted drafts it from your onboarding answers, listing customers, regulators, partners and others with their needs, and an administrator completes it from there.
How does Sted work out a risk’s level?
From likelihood and impact, each on a five-point scale from very low to very high. You pick both before controls and after them, and Sted computes the inherent and residual levels from a fixed matrix, so two people scoring the same way always get the same level.
Can I delete a row from a register?
No. Issues, objectives and risks can be retired, which keeps the row and its history. Other registers keep every row; edit a row that is out of date instead.
Do these registers satisfy ISO 13485?
Partly. ISO 13485:2016 does not have the context-of-the-organisation clauses that ISO 27001 and ISO 9001 share, but the scope, processes, objectives and risk registers still hold evidence a medical device auditor reviews.