The register is not the risk management
Registers record risk; they do not manage it. Risk management happens when a credible view of uncertainty changes a decision: a launch is phased, a control is strengthened, a contingency is funded or an opportunity is taken with eyes open.
Write risks people can act on
Vague risks such as 'project delay' cannot be owned. A useful risk statement describes the cause, the event and the consequence, so that controls can target the right point.
- Describe cause, event and effect in one sentence.
- Assign a single accountable owner with authority to act.
- Link each significant risk to the controls and actions that address it.
- Compare current exposure with the organisation's stated appetite.
Internal control as everyday discipline
Controls fail when they are designed for auditors rather than for the people who operate them. Simple, well-understood controls embedded in normal workflows are more reliable than complex ones performed once a quarter.
Resilience: continuing when things go wrong
Business continuity planning identifies the services that matter most, how long they can be interrupted and what resources they depend on. Plans must be tested, owners trained and lessons applied, otherwise they remain documents rather than capabilities.