Risks
Build a risk register, score inherent and residual risk, choose treatments and link risks to controls.
Updated 2026-10-21
The Risk register catalogs the risks to your organization with likelihood, impact and treatment.
Set up your register
- Agree a scale. Use the same likelihood and impact scale for every risk so scores compare fairly.
- Set your appetite. Decide the residual score above which a risk needs treatment or leadership sign-off.
- Seed the register. Import an existing register, or start from suggestions.
- Assign owners. Every risk needs one accountable person.
Suggest fifteen risks for a <industry> company of <headcount> people handling <data types> on <cloud provider>. For each give a short description, likelihood, impact, an owner role and the control that mitigates it.
Scoring
Each risk has an inherent score before controls and a residual score after them. Scores are likelihood times impact. See Inherent vs residual risk.
Treatment
Choose to mitigate, transfer, avoid or accept each risk. Accepted risks keep their justification and approver and appear in reports and treatment plans.
Which risks in my register have a residual score above our appetite? For each, suggest a treatment, the control changes needed and the expected new residual score.
Linking
Link risks to the controls that mitigate them. When a control fails or its evidence goes stale, the linked risk's residual score reflects it.
Review
Review the register at least quarterly and after major changes such as a new product, acquisition or incident.
Prepare a quarterly risk review: top ten risks by residual score, changes since last quarter, overdue treatments and decisions needed from leadership.