The risk register nobody reads

Most risk registers are write-only. Items go in during an audit, get a colour, and stay there until the next audit changes the colour. Nobody decides anything because of them.

Why they fail

They describe conditions, not decisions. "Insufficient patching of legacy systems: High" tells a leader nothing about what to do, what it would cost, or what happens if they do nothing. So they nod and move on.

What I'd put in instead

For each entry, five things:

1. The scenario. What actually happens: an attacker does X, we lose Y, for Z days.
2. The owner. A named person whose budget pays for the consequence.
3. The options. Reduce it, transfer it, accept it, with a rough cost for each.
4. The decision. Which option was chosen, by whom, on what date.
5. The trigger. What would make us revisit this: a new system, a new threat, a near miss.

A register with twenty entries like that is a management tool. A register with two hundred coloured rows is wallpaper.

The conversation it enables

When a board asks "what are our top risks," the answer stops being a heat map and becomes a short list of decisions already made, decisions pending, and the evidence behind each. That's a conversation a board can have. Colours aren't.

Where to start

Take the existing register, pick the five entries that would actually hurt, and rewrite those five the way above. Present them. Watch what happens to the meeting. Then decide whether the other hundred and ninety-five are worth the same treatment or worth deleting.

If you'd like help turning a register into decisions, that's exactly the kind of work I take on.

Explore: More on governance and risk · Work with me