# Risks

> Build a risk register, score inherent and residual risk, choose treatments and link risks to controls.

Source: https://docs.csquaregrc.com/guides/risks


The **Risk register** catalogs the risks to your organization with likelihood, impact and treatment.

## Set up your register

1. **Agree a scale.** Use the same likelihood and impact scale for every risk so scores compare fairly.
2. **Set your appetite.** Decide the residual score above which a risk needs treatment or leadership sign-off.
3. **Seed the register.** Import an existing register, or start from suggestions.
4. **Assign owners.** Every risk needs one accountable person.

```text
Suggest fifteen risks for a <industry> company of <headcount> people handling <data types> on <cloud provider>. For each give a short description, likelihood, impact, an owner role and the control that mitigates it.
```

## Scoring

Each risk has an **inherent** score before controls and a **residual** score after them. Scores are likelihood times impact. See [Inherent vs residual risk](/concepts/inherent-vs-residual-risk).

## Treatment

Choose to **mitigate**, **transfer**, **avoid** or **accept** each risk. Accepted risks keep their justification and approver and appear in reports and treatment plans.

```text
Which risks in my register have a residual score above our appetite? For each, suggest a treatment, the control changes needed and the expected new residual score.
```

## Linking

Link risks to the controls that mitigate them. When a control fails or its evidence goes stale, the linked risk's residual score reflects it.

## Review

Review the register at least quarterly and after major changes such as a new product, acquisition or incident.

```text
Prepare a quarterly risk review: top ten risks by residual score, changes since last quarter, overdue treatments and decisions needed from leadership.
```