How do we build a risk register from nothing?

Start

There is no risk register yet

Starting from a blank page tends to produce a list of topics: 'ransomware', 'phishing', 'GDPR'. Topics cannot be owned or scored. Start instead from a library of scenarios already written in the right form, and from the services the business cannot do without.

• Then: Is there an agreed method for scoring risks?

Decision

Is there an agreed method for scoring risks?

The method sets the impact and likelihood scales, the bands and who may accept each band. If an enterprise risk scale already exists, it counts. If nobody can point to an approved one, answer no.

• Yes: Choose a short list of risk categories
• No, or not approved: Adopt one scoring method before scoring anything

Step

Adopt one scoring method before scoring anything

Keep one scale for all risks: four levels of impact and likelihood, a matrix and four bands. If finance or enterprise risk already has a scale, use its money thresholds so 'Severe' means the same everywhere. Scoring first and fixing the scale later means scoring everything twice.

• Then: Choose a short list of risk categories

Step

Choose a short list of risk categories

Categories group risks that share one appetite, such as service availability, customer and personal data, financial fraud, regulatory compliance, third-party dependency, and people and insider. Keep few enough for the board to hold in mind, usually five to eight. Every risk will sit in exactly one.

• Then: List the services the business depends on

Step

List the services the business depends on

List the services and assets that matter, how critical each is, and the executive accountable for it. That executive is usually the owner of the risks to it. In a small organisation, start with your two or three most important services.

• Then: Pick the library scenarios that can happen to you

Step

Pick the library scenarios that can happen to you

Filter a scenario library by category, threat and where each applies. Leave out scenarios that cannot happen to you. Keep the ones that can, even if you think they are well controlled: the register should show that a risk was considered and is under control, not only that it is high. A category with nothing picked deserves a second look.

• Then: Add what your own sources already show

Step

Add what your own sources already show

Go through recent incidents and near misses, audit and penetration test findings, open security exceptions, threat reports relevant to your sector, planned changes, and concerns staff have raised. Each may add a scenario the library lacks, or show that one you picked is more likely than its starting score.

• Then: Reword each scenario for your own service

Step

Reword each scenario for your own service

Each risk needs four parts: threat, weakness, asset or service, and consequence. Name your own service, system or supplier. A scenario naming a real asset is a risk someone can own; a generic one is not.

• Then: Name one executive owner for each risk

Step

Name one executive owner for each risk

The owner is the executive accountable for the service or asset the risk would hurt, by role. Not the security team, which assesses and advises. Security owns a risk only where the harm falls on its own duties. In a small organisation one person may assess every risk, but each still needs an owner outside the security role.

• Then: Is the list short enough for owners to review every quarter?

Decision

Is the list short enough for owners to review every quarter?

Every risk is reviewed by its owner every quarter. For a small organisation the pack suggests 10 to 15 well-owned risks, which are better than 50 nobody reviews. If the list has grown past what owners will actually review, answer no.

• Yes: Score each risk before and after controls that work
• No, or not sure: Merge scenarios that are really one risk

Step

Merge scenarios that are really one risk

Several entries on one service often describe the same event. Merge them into one scenario scored at its worst consequence, and note which entries it replaces. Several scenarios often share one cure, such as multi-factor sign-in or tested backups, so one action may reduce many risks.

• Then: Score each risk before and after controls that work

Step

Score each risk before and after controls that work

A library's starting scores are typical levels, not your assessment. Rate impact on the worst consequence and likelihood over the next 12 months, first with no specific controls, then with the controls you have evidence for. A control without evidence does not count. A workbook per service keeps the working, and its result goes into the register.

• Then: Enter each risk once, in a single register

Step

Enter each risk once, in a single register

Give each risk a reference that never changes. Record the scenario, owner, category, ratings with reasons, controls, band and position. The register is the only record of assessed risks: the library and workbooks are sources, not second lists to maintain. Copy their results in as values.

• Then: Has the board approved an appetite for each category?

Decision

Has the board approved an appetite for each category?

Without an appetite, nobody can say whether a risk is acceptable. Who approves depends on how you are governed: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. If it is only in draft, answer no.

• Yes: Is any risk outside its category's appetite?
• No, or only in draft: Test a draft appetite against the register, then seek approval

Step

Test a draft appetite against the register, then seek approval

Ask each category's owner which harm the organisation would not accept even for a clear benefit, and pick Averse, Cautious or Open. Test the draft against the new register. If most risks land outside appetite, the level or the scores are wrong. If nothing lands outside in a category the board worries about, the level may be too loose. Send the result with the draft.

• Then: Is any risk outside its category's appetite?

Decision

Is any risk outside its category's appetite?

Compare each risk's residual band with its category's appetite and tolerance. The answer is a count: how many risks are outside appetite, and how many of those are past tolerance.

• Yes: Get a treatment decision for each one outside appetite
• No: A working register: reviewed quarterly, reassessed yearly

Step

Get a treatment decision for each one outside appetite

The owner decides to reduce, avoid, transfer or accept, within 30 calendar days of the risk first being assessed outside appetite in the pack's defaults. A risk past tolerance goes to the board chair out of cycle.

• Then: A working register: reviewed quarterly, reassessed yearly

Outcome

A working register: reviewed quarterly, reassessed yearly

From here the register is kept current by routine. Each owner reviews their risks every quarter, the whole register is reassessed once a year, and triggers such as a major incident or change force an earlier reassessment. The position against appetite is reported to executive management every quarter.