A risk register is a structured record of uncertainty affecting objectives and the organisation’s response to it. Its value comes from clear statements, responsible owners and current evidence. This article shows how to turn a vague concern into a usable entry, distinguish existing controls from future actions and review the record without treating a score as a precise prediction.
Write a cause, event and effect
“Supplier risk” is a category, not a complete description. A useful statement explains the condition creating uncertainty, what might happen and which objective could be affected. Keep it specific enough that an owner can investigate and act.
For example: because a critical part has only one approved supplier, a supplier interruption could delay scheduled installations and breach customer commitments. The statement identifies a dependency, a possible event and a consequence. It can be checked against procurement and delivery evidence.
Use fields that support a decision
First define the objective, work scope and assessment period. The risk owner monitors the risk and coordinates the response within their authority. Another person may deliver a specific treatment action. Risk exposure describes the likelihood and consequences the organisation faces in that context.
| Field | Purpose |
|---|---|
| Objective and risk statement | Explain what is uncertain and why it matters |
| Risk owner | Identify who monitors the risk and coordinates response and escalation |
| Existing controls | Describe what operates now and its evidence |
| Assessment | Record likelihood, consequences and uncertainty |
| Actions and dates | Record each action, its owner, deadline and acceptance evidence |
| Review trigger | State when reassessment or escalation is needed |
Add fields only when they change management decisions or provide necessary traceability. An extensive spreadsheet can still be ineffective if no one owns the entries or checks whether the controls work.
Separate a control from an action
A control is an arrangement currently operating to influence the risk. An action is work planned to improve the situation. “Approve an alternative supplier next month” is an action. It should not reduce today’s assessment as though the alternative were already available and tested.
For each important control, identify evidence of operation. A policy may state an expectation, but the relevant evidence could be completed checks, exception records or a successful test. Record weaknesses honestly. Having a control name in a cell does not establish effectiveness. Neither does the absence of a recent incident prove that a control works.
Worked entry: a single-source component
In a fictional company, the operations manager owns the risk of installation delays caused by a single-source component. The existing control is a weekly check of confirmed supply against scheduled jobs. The evidence is the dated comparison and recorded exceptions.
The planned action is to assess and test an alternative component source. Procurement owns that action, with a defined completion date and technical acceptance criteria. The operations manager remains the risk owner; delegating an action does not remove responsibility for the overall exposure.
A missed confirmed shipment or a material increase in lead time triggers review. If a customer commitment is at risk, the agreed escalation rule applies before new commitments are accepted. The entry records the decision and remaining exposure, rather than merely changing its colour. This educational example does not describe a real client.
To make the action verifiable, the company sets a hypothetical deadline of 30 days for presenting the alternative source test results. A technical specialist checks the component against approved specifications. The procurement lead confirms the source can meet supply commitments. One successful sample does not establish supply continuity. Weekly monitoring continues until the risk owner reviews the evidence and updates the assessment. The 30-day period is an illustrative assumption, not a general benchmark.
If testing cannot finish on time, the action owner records the reason and the interim response. If exposure exceeds agreed limits, they escalate to the authorised decision-maker with the threatened commitments and available options. They do not wait for a scheduled meeting when the situation requires an earlier decision.
Use ratings carefully
Likelihood and consequence scales can help compare risks when their meanings are defined. A label such as “likely” needs a stated context and timeframe. Consequences may include safety, service, finance, compliance and reputation; one financial threshold may not represent them all.
Ordinal scores rank categories such as low, medium and high; they do not establish equal distances between those categories. Where a matrix multiplies these scores, the result is a prioritisation aid, not a measured probability or exact expected loss. Explain the basis and uncertainty. A rare but severe event may require action even if its combined score looks lower than a frequent minor issue.
Distinguish the assessment before specified controls from the assessment with current controls, if your method uses both. State the assumptions. Residual risk is what remains after taking implemented controls into account. Do not present a desired future level as the current residual risk. A reviewer should be able to identify the controls considered and the evidence supporting their effectiveness.
Review the evidence, not only the due date
Ask what has changed in the objective, exposure, controls and operating context. Check whether completed actions produced the intended effect. A task marked complete may still leave the control untested or the original problem unresolved.
Use scheduled reviews and event-based triggers. Incidents, near misses, new suppliers and significant process changes may justify earlier reassessment. Keep enough history to explain why a decision changed, while making the current position easy to find.
Close or archive an entry when the exposure genuinely no longer applies under the organisation’s criteria. Do not close it merely because an action finished. If uncertainty has become an actual issue, manage the issue and assess the remaining or recurring risk separately.
Confirm responsibility when people change roles
If a risk owner or action owner changes roles, review responsibility, authority and access to evidence together. Updating a name is insufficient unless the incoming owner understands the controls, open actions and escalation triggers. Record the handover and next review date. Keep current exposure visible while confirming the new owner understands the entry and the support needed. A change of personnel does not mean the risk has ended.
Build the first register around actual decisions
Begin with a small number of material uncertainties linked to current objectives. Review them with the people doing the work and those authorised to accept or change the exposure. A workshop is useful only if its conclusions become owned decisions and follow-up.
HM Treasury’s Orange Book supports principles of clear responsibilities, control monitoring and review. It primarily addresses the UK public sector. The fields and example here are editorial explanations, not a mandatory template or UAE regulatory requirements.
Use the risk appetite and escalation article to connect entries with authority limits, and the ISO 31000 article for the wider framework. ATMACSS risk management support can help establish a register that is proportionate, reviewable and connected to operating decisions.
Before approving the register, ask each risk owner to explain the possible event, operating controls, next action and completion evidence. Record the decision, its date, the authorised decision-maker and the next review date. Complete any missing answers before relying on the entry for a decision.