Risk Register

Last updated:

What it is

The Risk Register is a governance tool for recording and managing risk in the style of ITIL and ISO 27005. You keep separate registers, one for each customer plus any internal registers, and work each register's risks through their lifecycle. Every risk is scored on a five by five Likelihood and Impact matrix so the whole register can be read at a glance.

Turn the tool on at Helpdesk, Settings, Tools, then open Helpdesk, Governance, Risk Register.

Registers

The tool opens on a list of registers. Choose one to see its overview and its risks. Create a register for a specific customer, or an internal register for your own operations. Keeping registers separate means each customer's risks, reviews and reports stay in their own space.

Adding and scoring a risk

  1. Add a risk with a title and a description of the threat.
  2. Score its Likelihood from 1 to 5 and its Impact from 1 to 5. The register draws a colour heatmap with labelled axes, and each risk sits in the cell that matches its score, from green (low) through amber to red (high).
  3. If you want to show the effect of your controls, record both an inherent score (before treatment) and a residual score (after treatment).

Lifecycle and treatment

Each risk moves through a lifecycle: Identified, then Assessed, then Treating, then Monitoring, then Closed. Choose a treatment strategy for each risk: Mitigate (reduce it), Accept (live with it), Transfer (insure or outsource it), or Avoid (stop the activity). You can change status and treatment directly from the risk table without opening the risk.

Details, notes and history

Select a risk to open its side drawer, which has three tabs:

  • Details, where you edit the risk in place, including its owner and its links to related assets, services and tickets or problems.
  • Notes, a running list of dated notes.
  • History, a field level audit trail that records every change, who made it and when.

Review meetings

The Reviews tab runs risk reviews in the same style as a Change Advisory Board. Schedule a review with a chair, attendees (your own staff plus the customer's contacts), an agenda, and the risks to be discussed. During the meeting you record a decision on each risk and re-score its likelihood and impact. When you choose Mark held, the new scores are written back to the actual risks, the change is captured in each risk's History, and the register's last reviewed date is stamped. You can also send a Teams or Outlook calendar invitation for the meeting.

Connectivity map

The Connectivity tab draws an interactive dependency graph. Each risk appears as a node coloured by severity, joined to the assets, services, tickets, problems and changes it links to. Drag a node and the graph ripples and settles, scroll to zoom, and hover over any node for a quick summary. Turn on edit mode to add or remove links directly on the map, which then updates the underlying risk.