Enterprise risk
The register is the artifact
A risk that is not written down with an owner is not managed. Each entry carries:
- The risk stated as a cause and consequence — "if X happens, then Y." "Cybersecurity" is a category, not a risk. "If an employee's credentials are phished, an attacker reaches customer records" is a risk you can do something about.
- Likelihood and impact, on a stated scale, with the reasoning. The reasoning matters more than the score.
- Current controls and an honest view of whether they work.
- Residual risk after those controls — the number that actually matters and the one most often omitted.
- A named owner. A person, not a department.
- Treatment and a date.
Treatment is a decision with four options
Mitigate (reduce it), transfer (insure or contract it away), avoid (do not do the thing), or accept. Accepting is legitimate and often correct — but acceptance must be explicit, at the right level of authority, and recorded. Risk accepted by silence is risk nobody owns.
Anything above the threshold that only the chief executive can accept goes to them. Never let an unacceptable risk be quietly downgraded to fit an existing authority.
Scoring honestly
Two failure modes, both common:
- Everything is high. The register stops discriminating and gets ignored.
- Scores drift downward as items age without the underlying exposure changing.
Re-assess on a schedule and require evidence for any reduction. A control's existence is not evidence it works; a test of the control is.
Audit readiness
Continuous, not a project. What auditors need: documented policies, evidence they are followed, records of exceptions and approvals, and a clear line from the framework's requirement to your control to the evidence.
Collect evidence as work happens. Assembling a year of it retrospectively is expensive, and gaps found then cannot be fixed retroactively.
Reporting
Leadership needs the few risks whose residual exposure is above appetite, what is being done, and what needs a decision. Not the whole register. A risk report that requires reading forty rows to find the three that matter will not be read.
Sources
references/sources.md in this skill lists the outside authorities that settle the questions
here — what each one is authoritative for, and what you may do with it. Check them before
answering on anything they cover, and cite what you used. Most are free to read and not free
to reproduce; the use note on each is binding.
Tooling
A risk register is a table, and for most organizations a spreadsheet or a database in Notion, Airtable, or Confluence is the honest answer. Dedicated platforms — LogicGate, AuditBoard, Riskonnect, ServiceNow IRM, and similar — earn their place when the register has to reconcile with audit findings and control testing in one system.
Compliance automation tools cover control evidence, not enterprise risk. Do not let one stand in for the other.
Never
- Score residual risk on controls that are planned rather than operating.
- Accept a risk without naming who accepted it and when it is reviewed again.
- Keep a register with no review cadence. That is documentation, not risk management.
- Close a risk because the project that raised it ended.
