Risk Register (Expanded)
The template applies the following process for assessing enterprise risks:
1. Capture the goals of the organisation. Goals are high-level outcomes and are also sometimes called Key Performance Areas (or strategic thrusts).
2. Capture information about risk categories. Risk categories are the elements of the organisation's risk classification system.
3. Capture the key organisational controls that must mitigate risks. Provision is made for a maximum of 15 such controls. If your organisation consists of a large number of such controls, try to identify the core ones, or use the template separately for different structures.
4. Capture the mitigating values dependent on the effectiveness of controls.
5. Identify the risk threshold: Every organisation has a limit (a threshold) to absorb risks. This threshold will dependent on the strength of the organisation to accept risk without being destroyed by it. The stronger the organisation (in terms of governance and management efficiency, the availability of sources, and its ability to convince external stakeholders) the higher its threshold. Threshold will be based on residual risk, and the maximum risk threshold on this template is 5.
6. Capturing of organisational strategic objectives above. The template makes provision for up to 15 individual objectives. Remember, strategic means very high level objectives (actually, only critical and final indicators of the success or failure of your organisation are measured.
7. The template use not only the likelihood that a risk may mature, and the impact if it does, but also the vulnerability of the organisation to risks and the velocity of risk response in determining inherent risk levels. The user must determine these assessment values.
8. The identification of individual risks.
9. The alignment of the identified risks to identified objectives, risk categories and risk controls.
10. The assessment of individual risks.
The spreadsheet subsequently generates the following reports:
1. The level of risks to which the identified organisational goals and objectives are exposed, expressed in inherent and residual values.
2. The levels of inherent and residual risks to which the identified organisational controls are exposed.
3. The levels of inherent and residual risks associated with each of the identified risk categories.
4. A detailed risk report, exposing the inherent and residual risk level of each of the identified risks, compared with the identified risk threshold levels.
5. The categorisation of risks according to status in relation to the identified risk threshold level.
The template translate all assessment values back to “5”; which simplifies the identification of a risk threshold level (which is then also reflected in a value /5).
){kind=link}