One term we hear a lot from clients who are responsible for risk management in their organization is “risk register.” It is a repository of risks that could impact different entities within a company. The purpose of a risk register is to provide a view of all potential risks in one centralized location, complete with risks’ owners, prioritization, and response actions.
In the past 12-18 months, I have seen multiple ways through which organizations manage their risks. On most occasions, this consists of an extensive spreadsheet. Sometimes a ticketing tool like JIRA works in combination with these spreadsheets as well. Unfortunately, these spreadsheets are often inefficient in maintaining accurate, current information.
Consider these attributes that define a risk and need to be tracked in a risk register:
- Risk Title or Statement: This is a short title explaining the risk at a high level.
- The “What, Where, and Why” of the Risk: This provides more details of the risk, such as what it consists of, where it was identified, and why it is a risk.
- Category: IT, Operational, Compliance, Audit, Strategic, Financial, Reputational, etc.
- Risk Owner: The user or group responsible for overall management of a risk
- Risk Delegates or Task Owners: Risk owners often require assistance from other resources when managing a risk, so it is important to have an additional resource group available for delegating risk management.
- Prioritization Parameters: In many cases, various components are used to define risk severity. These components are often “impact” and “likelihood.” Velocity and criticality of entity are some additional parameters.
- Prioritization Algorithms and Levels: Most organizations like to keep simple 4 X 4 or 5 X 5 levels for impact and likelihood. Some have also used different levels, like 5 X 3. Sometimes, organizations have unique algorithms that combine multiple parameters to attain a risk score, which determines the severity for that risk.
- Inherent/Current/Residual Risk Severity: Risk severity is identified based on the threshold of the risk score. A high score indicates a critical or severe risk for the organization. I have often seen different levels for inherent/current/residual levels for more analysis. These levels, along with severity titles, are typically colored within the spreadsheets.
- Response/Treatment Plans: A risk that is part of the risk register requires a treatment plan. That plan could have multiple tasks with defined end dates. Sometimes, there are several different plan options being used—like Remediate, Accept, Policy Exception, etc.
- Present Status: This provides a view of a risk’s present status, including updates from multiple resources or meetings and updates from the remediation plan.
- Trending: I have also seen organizations keeping a column of risk trend to give the leadership team insight on the historical view of the risk.
Using the information added in the risk register, organizations can build interesting reports and KPIs. The most common are heat maps with representations of risk severity levels across impact and likelihood. The maps can also provide further details on inherent, current, or residual levels. These dashboards and reports are often used in strategy meetings with leadership teams.
Precise governance of the risk register enables management to make well-versed decisions. Developing a comprehensive risk repository is never a waste of resources. It is an investment that keeps your executives apprised of the latest risks—and allows them to make proactive decisions that protect your company.
If you’re struggling to maintain a robust risk register for your organization, set up a TruOps demo with me. TruOps has a risk repository module with risk register built in, which means it prevents manual errors and provides you with better visibility of risks. Our all-in-one solution allows you to use a web-based risk register with email notifications, dashboards, reports, configurations, and more to help you remediate risks and prevent security threats. Schedule your demo now.
