Enterprise DNA

Instead of Camms

Stop renting Camms. Own your risk system.

We build your version around your risk matrix, your appetite and the rules you report against. We bring your Camms register across and run it for you.

Camms, now part of Riskonnect, publishes no price. It is sold by quote, module by module. Bring your last invoice to the call.

Get your version built See it working
  • check_circleYour data in a database you own
  • check_circleOpen source, no lock-in
  • check_circleBuilt and run by Enterprise DNA

What the subscription covers

You pay for screens over a register

A risk system holds a register, the controls and actions that hang off it, an incident log and a calendar of reviews. Look at which part of the quote is the record and which part is the screens.

request_quote

A price you only see in a quote

Camms does not publish its prices. Each module is quoted, so the total depends on what was bundled at the last renewal.

view_module

Modules sold separately

Riskonnect lists risk, compliance, audit, health and safety, and business strategy as separate products. Check which ones your team opens each week against the invoice.

table_view

The register itself

Risks, ratings, owners and review dates. This is plain data, and it is the part you most need to own.

grid_on

Heat maps and dashboards

The five by five grid and the committee charts are views of that register. Your own version draws them from the same records.

notifications_active

Workflow and reminders

Review reminders, approvals and escalations. Your own version keeps them as dated records and a Monday list for every owner.

swap_horiz

A new owner of the product

Camms joined Riskonnect. Owning your register means the next change of ownership is not your problem.

The system you own

Run the risk calendar from one place

Notice clocks

Know when a regulator must hear from you

Record when the business became aware of an incident, and every clock that applies starts from that time.

  • check APRA notice within 24 hours of a critical operation disrupted outside tolerance
  • check APRA notice within 72 hours of a material operational risk incident
  • check Australian breach assessment within 30 days, then notice as soon as practicable
  • check A New Zealand privacy breach flagged until the Privacy Commissioner is told

Register and appetite

See the risks the board has not accepted

Every risk is rated on your matrix and checked against the appetite your board set for its category.

  • check Risks over appetite with no treatment under way, listed first
  • check Ratings that moved since the last committee meeting, with the reason
  • check Risks that had an incident after their last review
  • check Your own labels, rating bands and review cycles

CPS 230

Keep the operational resilience records

Critical operations, tolerance levels, continuity exercises and material service providers, checked against the standard paragraph by paragraph.

  • check Critical operations with no exercise in the last year
  • check Missing outage and data loss tolerance levels
  • check Provider agreement changes APRA has not been told about, counted in business days
  • check Controls past their test date, and incidents not linked to a risk

Committee pack

Write the report from the records

The risk committee report is drafted from the register, so the numbers in the pack are the numbers in the system.

  • check Heat map, risks over appetite and rating movement since a date
  • check Incidents in the period and every rule finding with its source
  • check Overdue actions and attestations by owner
  • check Draft notices to APRA, the Privacy Commissioner or the OAIC, never sent without a person

Make it yours

Design your own Camms replacement

Everything starts from the open-source base. Then it gets your name, the parts you run, your rules and your data from Camms. Try it here, and we build the real one.

2. What it runs

3. Make it fit

4. Your colour

Your business · your Camms replacement Your version
YB Your business

auto_awesome

Answered from your own database

Build my version

We build it from the open-source base, bring your Camms data across and run it for you.

What it looks like

Ask it like you would ask a colleague

Real answers from the demo data that ships with Risk and Compliance for Claude Code. It runs in Claude Code inside the Claude app, so it feels like any chat you already use.

forum

Risk and Compliance for Claude Code

Connected to your own database

Which incidents have a notice clock running, and when does each one end?

INC-3

Title
Member statements posted to old addresses
Kind
incident
Severity
moderate
Owner
Hana
Days_open
33
Ndb_assess_by
2026-10-06
Privacy
AU
Open_actions
0

INC-1

Title
Card payments down for six hours
Kind
incident
Severity
major
Owner
Priya
Days_open
1
Risk
R-003
Critical_operation
OP-1
Apra_24h_due
2026-10-09 05:24
Apra_72h_due
2026-10-11 05:24
Open_actions
0

INC-2

Title
Staff member entered password on a phishing page
Kind
near-miss
Severity
minor
Owner
Marcus
Days_open
10
Risk
R-002
Open_actions
0

INC-4

Title
NZ member list emailed to the wrong recipient
Kind
incident
Severity
moderate
Owner
Hana
Days_open
4
Risk
R-002
Privacy
NZ
Privacy_notifiable
true
Open_actions
1

Ask it anything

Ten questions for your next risk committee

Each question runs against the fictional demonstration organisation today. Your own records answer the same questions once they are brought across.

chat_bubble Which risks sit over appetite with no treatment under way?
chat_bubble Which incidents have an APRA notice clock running, and when does it end?
chat_bubble Which material service provider agreements changed without a notice to APRA?
chat_bubble Which critical operations have gone more than a year without a continuity exercise?
chat_bubble Which risks had an incident after their last review?
chat_bubble Which controls are ineffective or never tested, and which risks rely on them?
chat_bubble Which residual ratings moved since the last committee meeting, and why?
chat_bubble Which privacy breaches still need an assessment or a notice?
chat_bubble Which compliance obligations are overdue for attestation or last recorded a breach?
chat_bubble Who holds the most overdue reviews, tests and actions?

Switching

How to switch from Camms

In practice, the move involves exporting the records you need, mapping Camms headings and rules, checking imported drafts, and reconciling both systems before you switch.

  1. 1

    Export your Camms records

    Export your risk register report as CSV. Camms report headings vary by configuration, so check with Camms if you are unsure how to export the fields you need. Controls, actions, incidents and attestations are in separate reports, so export those too if you want them included and your account allows it.

  2. 2

    Test the risk register import

    Load the risk register using the import, and run its test option first so you can check the results without saving anything. Match your Camms headings to the fields in the new database where needed. Risks that come across are drafts for checking, and the import keeps the original row.

  3. 3

    Check the import results

    Review the draft risks and any rows or headings the import flags before you rely on the new register. Check that the fields landed where you expect and that the records make sense to your team. Repeated imports leave unchanged records alone, while a row that has changed since the last import stops the run for review.

  4. 4

    Run both systems briefly

    Keep Camms and the new database in use side by side for a short period. Compare the records and updates your team relies on, including any controls, actions, incidents or attestations you chose to bring across. Use this time to resolve mapping gaps and confirm that people can find the information they need in the new system.

  5. 5

    Switch off Camms

    Once you have checked the imported records and reconciled the two systems, make the new database your working source for risk and compliance. Tell the people who maintain the records where to make updates from then on. Switch off Camms when you are satisfied that the information you need has been brought across and checked.

construction

Where the real effort goes

The work usually sits in mapping your own Camms fields and rules, then deciding which records and history to bring across. The risk register import handles usual headings and lets you map your own, but controls, actions, incidents and attestations come from separate reports. If Enterprise DNA runs the installation, they do this mapping and reconcile the move with you.

Not ready for a call?

Get your Camms switch plan by email

We will send you the step-by-step plan for moving your business off Camms, what the move really involves, and how we would do it for you.

One email with your plan. No spam, and you can unsubscribe any time.

Three ways to own it

Start with the free version or have yours built

Open source

Do it yourself

Free, open source

  1. 1 Clone the repo and run npm install
  2. 2 Run npm run demo to try the fictional mutual
  3. 3 Open it with Claude Code, Codex, OpenCode or Cursor
  4. 4 Export your Camms risk register to CSV and dry-run the import
Get it on GitHub

Built around your business

We customise it

A setup fee, then a retainer for ongoing work

  • check Your risk matrix, categories, appetite and review cycles
  • check Your Camms register, controls, actions and incidents brought across
  • check A web front end and approvals for risk owners if your team wants them
  • check The rules you report against, written down with their sources
Get your version built

Omni by Enterprise DNA

We run it for you

One setup fee, then a retainer

  • check Installed and operated through Omni by Enterprise DNA
  • check Access, backups and recovery agreed with your organisation
  • check The weekly risk review and the committee pack drafted on time
  • check A person to call when a standard or your framework changes
Book a call

Questions

Instead of Camms, answered

Will our Camms register come across? expand_more

The free version imports a risk register report saved as CSV. It reads the usual headings, lets you map your own, keeps every original field and brings each risk in as a draft for checking. Controls, actions, incidents and attestations sit in other Camms reports. Enterprise DNA maps those and reconciles the move with you.

Does it decide whether we must notify APRA or the Privacy Commissioner? expand_more

No. A responsible person decides whether an incident is material or a breach is likely to cause serious harm, and that decision is recorded. The system then shows the clock that applies, drafts the notice for checking and flags it until someone records that it was made.

We are a council, not APRA-regulated. Is it still useful? expand_more

Yes. The CPS 230 checks switch off for organisations that are not APRA-regulated. The register, appetite, controls, incidents, obligations, privacy rules and committee report work the same for a council, a not-for-profit or a professional firm.

What if our risk owners need a screen and approvals? expand_more

Tell us on the call. Enterprise DNA builds a web front end, approval steps and reminders onto the same database for the people who want them. The register underneath stays yours either way.

How does the cost compare with Camms? expand_more

Camms is sold by quote, so bring your last invoice and the modules it lists. Our installed version has one setup fee, then a retainer for the work we agree. The free version costs only hosting and your agent if you run it yourself.

Make the next committee pack yours

Book 30 minutes with Sam. Bring your Camms invoice, one register export and the rules you report against. We will map the records, the clocks and the pack your version needs.

Book a discovery call Get the free version

Risk and Compliance for Claude Code is free and open source, published by Enterprise DNA.

Done paying for Camms?

Get your version built