enterprise-risk

Enterprise risk

The register is the artifact

A risk that is not written down with an owner is not managed. Each entry carries:

• The risk stated as a cause and consequence — "if X happens, then Y." "Cybersecurity" is a category, not a risk. "If an employee's credentials are phished, an attacker reaches customer records" is a risk you can do something about.
• Likelihood and impact, on a stated scale, with the reasoning. The reasoning matters more than the score.
• Current controls and an honest view of whether they work.
• Residual risk after those controls — the number that actually matters and the one most often omitted.
• A named owner. A person, not a department.
• Treatment and a date.

Treatment is a decision with four options

Mitigate (reduce it), transfer (insure or contract it away), avoid (do not do the thing), or accept. Accepting is legitimate and often correct — but acceptance must be explicit, at the right level of authority, and recorded. Risk accepted by silence is risk nobody owns.

Anything above the threshold that only the chief executive can accept goes to them. Never let an unacceptable risk be quietly downgraded to fit an existing authority.

Scoring honestly

Two failure modes, both common:

• Everything is high. The register stops discriminating and gets ignored.
• Scores drift downward as items age without the underlying exposure changing.

Re-assess on a schedule and require evidence for any reduction. A control's existence is not evidence it works; a test of the control is.

Audit readiness

Continuous, not a project. What auditors need: documented policies, evidence they are followed, records of exceptions and approvals, and a clear line from the framework's requirement to your control to the evidence.

Collect evidence as work happens. Assembling a year of it retrospectively is expensive, and gaps found then cannot be fixed retroactively.

Reporting

Leadership needs the few risks whose residual exposure is above appetite, what is being done, and what needs a decision. Not the whole register. A risk report that requires reading forty rows to find the three that matter will not be read.