Chapter 3 of 13 · Days 2–10
Finding the Risk Register and Its Real Owner
- Where is the risk register, and is it the real one?
- Who actually owns these risks?
- What do I do if the register is years out of date?
Somewhere there is a risk register. It might be a spreadsheet, a tool, or a tab in a board pack. There may be more than one. Your job in week one is to find out which one people actually use to make decisions.
Test the register in an hour
- Pick five risks at random.
- For each one, ask the named owner: do you know you own this? When did you last look at it?
- Check the controls listed against it. Do they exist? Is there recent evidence?
- Check the dates. When was each risk last reviewed?
- Look for big risks that are missing: a key supplier, an old system everyone is afraid to touch, a new AI tool.
This small test tells you more than reading the whole register. You will usually find three kinds of row: live risks with real owners, risks owned by someone who left, and risks owned by a team name rather than a person.
Ownership is the first fix
A risk owner is the person with the authority and budget to decide what happens to the risk. It is not the person who writes the entry, and it is usually not you. If an owner does not know they own a risk, the risk is not being managed. It is being stored.
- Give every risk one named person, not a team or a role that nobody holds.
- Agree the owner with their manager, not only with them.
- Record the decision: treat, accept, transfer or avoid, with a date to look again.
- Separate the risk owner from the control owner. They are often different people.
The question you might not ask out loud
The register is a mess. Should I rebuild it from scratch?
Not yet. Rebuilding first loses the history and annoys the people who wrote it. Fix ownership and dates on the top risks, then improve the format once people trust it.
Rule of thumb:Write risks as cause, event and impact: "Because backups are not tested, a ransomware attack could cause a week-long outage of billing." That sentence tells an owner what to fix.
By the end of your second week you should be able to name the top ten risks, their owners and when each was last reviewed. If you can, you already know more than many people in the building.