Stop 11 · GRC: Governance, Risk & ComplianceTopics · 9/9

Building a Risk Register

In short

Risk talk is useless if it lives in meeting chatter. A risk register writes every risk down with an owner and a deadline, so nothing quietly slips away.

A living document tracking identified risks, their assessment, owner, and mitigation status — the practical artifact that turns Phase 11's risk assessment concepts into an ongoing, managed process.

The blob as a kirana shopkeeper writes in a thick ledger beside jars of sweets.

Think of it like this

The kirana store's udhaar khata

The kirana uncle writes every credit in his khata: who owes, how much, since when, and when they promised to pay. He checks it every week. A risk register is that khata for security: every risk, its size, its owner and its due date.

Watch it happen

Sorting risks by score

R1: 6

R2: 20

R3: 9

R4: 15

R5: 4

1/5Five risks with their likelihood times impact scores, in the order they were written down.

The big ideas

What you need to know

Core columns

ID, description, likelihood, impact, score, owner, treatment, due date and status. Keep it simple enough to update.

Write risks clearly

Use "cause, event, effect": because the VPN is unpatched, an attacker could get in, leading to a data breach.

Owners are people

"IT team" is not an owner. Name one person who will answer for progress.

Review it regularly

Go through the top risks monthly. Close finished ones and add new ones from audits, incidents and projects.

See it in code

Walk through the code

excel

1// Columns: A ID | B Risk | C Likelihood (1-5) | D Impact (1-5)2// E Score | F Rating | G Owner | H Due | I Status3 4E2: =C2*D25F2: =IF(E2>=15,"High",IF(E2>=8,"Medium","Low"))6J2: =IF(AND(I2<>"Closed",H2<TODAY()),"OVERDUE","")7 8// Sort the sheet by column E, largest first

1/3Lay out the columns once. Each row is one risk.

Three small formulas turn a plain sheet into a working register: a score, a rating band and an overdue flag that catches forgotten fixes.

Save yourself the pain

Common mistakes

Oops

Adding a hundred risks on day one and never updating them.

Do this instead

Start with ten to twenty real risks. A short register that is reviewed beats a huge one that is stale.

Oops

Vague risks like "hackers" or "cyber attack".

Do this instead

Be specific about cause and effect, so the owner knows exactly what to fix.

Your mission

Build a register in Sheets

~35 min

Quick check

Which risk register entry is written best?

Go deeper

1Build a simple risk register template with columns for risk, likelihood, impact, owner, and status.
2Populate it with 5-8 hypothetical risks for a practice organization.
3Learn why a risk register needs regular review, not a one-time creation and abandonment.