A risk register should help an organisation make decisions. Its value comes from the quality of the discussion and follow-up around it, rather than the number of entries or the complexity of the scoring.
Describe the risk clearly
A broad label such as "supplier risk" offers limited guidance. A more useful description identifies what might happen, why it might happen and what the consequences could be for the activity under review.
Keep the scope clear. A risk associated with one project may need a different assessment from a similar issue affecting the whole organisation.
Distinguish controls from intentions
Record the measures already in place separately from proposed actions. An intended improvement does not reduce current exposure until it has been implemented and is working as expected.
Consider the evidence for each control. A written process, an assigned responsibility and an actual record of the process being followed answer different questions.
Use scores to support judgement
Likelihood and impact scores can help compare risks when the underlying criteria are understood. They are still estimates. A score should not hide uncertainty, a critical dependency or a consequence that needs separate attention.
Record assumptions and explain significant changes so that future reviewers can understand the reasoning.
Give actions a clear owner
For each agreed action, identify who is responsible and when progress should be reviewed. Risk ownership and action ownership may sit with different people, so make the relationship explicit.
Review the register when relevant circumstances change. A new service, supplier or operating process may change the position even if no scheduled review is due.
This article provides general information, not an assessment of a particular organisation's risks or controls.
