What a quarterly register knows
The top risks at a company with a well-run programme, as the register holds them.
The risk register
Top risks, their current rating, when it was last changed, and what changed it
| Risk | Rating | Last updated | Basis |
|---|---|---|---|
| Cyber and information security | High | 3 months ago | Workshop judgement |
| Third-party dependency | Medium | 3 months ago | Workshop judgement |
| Change and delivery | Medium | 6 months ago | Workshop judgement |
| Regulatory change | Low | 9 months ago | Workshop judgement |
Why it matters
Every rating here came from a room, and one of them is nine months old. Nothing is wrong with the judgement in that room; the problem is that the world moved and the register did not.
Workshops are not the problem
They are the right forum for a genuinely difficult judgement about a risk nobody can measure. They are the wrong mechanism for a risk that has four measurable indicators already flowing through the organisation, being discussed once a quarter by people reading a slide.