Risk Register

The Risk Register turns identified exposure into an owned management decision. A framework score describes assessment posture; a risk record describes an uncertain event or condition, its impact, the treatment decision and who is accountable for it.

Sources of risk

Create or link risks from:

intake and risk-tiering decisions;
framework gaps or failed control tests;
findings and evidence deficiencies;
Discovery alerts and unregistered AI;
supplier, model, data or regulatory change;
agentic simulations, runtime denials and incidents;
manual management or audit review.

Avoid one generic “AI risk” covering unrelated causes. A useful statement connects a cause, event and consequence, for example: “Because customer prompts may contain special-category data, sending them to an unapproved provider could cause unlawful disclosure and customer harm.”

Minimum defensible record

Field	Purpose
Title and statement	Identifies the risk and causal scenario.
Linked system	Establishes scope and ownership boundary.
Category and source	Explains where the risk arose.
Inherent exposure	Records exposure before the claimed treatment.
Existing controls	Identifies what is already reducing likelihood or impact.
Residual exposure	Records the post-control judgement and its basis.
Treatment	Avoid, reduce, transfer or accept, with actions and evidence.
Owner and due date	Assigns accountable action and review timing.
Status	Tracks open, treating, accepted, closed or superseded state.
Review trigger	Defines when the judgement must be revisited.

Operating workflow

Link the risk to the correct system and source record.
Write a specific cause-event-consequence statement.
Assess exposure using the organisation’s approved method.
Identify controls and evidence actually operating, not planned controls.
Select treatment, assign an owner and set dates.
Link remediation work, tests and findings.
Obtain the required acceptance or escalation decision.
Review after material change, failed treatment, incident or due date.

Closing a finding does not automatically eliminate its underlying risk. Close the risk only when the treatment and residual decision are supported, or mark it superseded when a replacement record preserves the history.

Governance Weighting Profile

The Governance Weighting Profile can change how the organisation prioritises review, escalation and assurance. It does not rewrite the factual system scope or erase a risk. Document any management judgement applied above the calculated result.

Quality checks

The risk is system-specific and understandable without oral explanation.
Inherent and residual judgements are not confused.
Controls have linked evidence or tests.
Acceptance is within the approver’s authority and time-bounded where appropriate.
Overdue actions and high residual risks are escalated.
Changes in model, data, supplier, autonomy, geography or law trigger review.