For any area of the company, from strategy, finance and suppliers to people, safety, compliance and technology: each area you tick lists its risks for you to choose, and you add your own. Each risk states its source, what it affects, its possible causes, its consequence, the measures you already have against it and its owner. Nothing is assumed and nothing is rated: the list is ready for the risk assessment.
Columns of the register
AreaRiskAffected activities and assetsConsequenceRisk owner
1
Any area
Strategy, finance, operations, people, safety, compliance, suppliers and technology.
2
Chosen by you
Each area lists its risks: you keep those that concern you and add your own.
3
Complete
Source, what it affects, causes, consequence, measures in place and owner.
What you provide
Deliverable — Its title, its author and its structure are yours: they steer what is written.
What is identified — Tick each area of the company concerned, from strategy to daily operations: each one opens its own list of risks to choose from.
Strategy and market — Choose the risks that concern you, add your own, and say what this area covers here.
Governance and decisions — Choose the risks that concern you, add your own, and say what this area covers here.
Reputation and communication — Choose the risks that concern you, add your own, and say what this area covers here.
Cash flow and liquidity — Choose the risks that concern you, add your own, and say what this area covers here.
Fraud and payments — Choose the risks that concern you, add your own, and say what this area covers here.
Accounting and reporting — Choose the risks that concern you, add your own, and say what this area covers here.
Service delivery and production — Choose the risks that concern you, add your own, and say what this area covers here.
Quality and customer claims — Choose the risks that concern you, add your own, and say what this area covers here.
Business continuity — Choose the risks that concern you, add your own, and say what this area covers here.
Premises and equipment — Choose the risks that concern you, add your own, and say what this area covers here.
Project delivery — Choose the risks that concern you, add your own, and say what this area covers here.
Change and transformation — Choose the risks that concern you, add your own, and say what this area covers here.
Recruitment and key people — Choose the risks that concern you, add your own, and say what this area covers here.
Health and safety — Choose the risks that concern you, add your own, and say what this area covers here.
Conduct and ethics — Choose the risks that concern you, add your own, and say what this area covers here.
Employment law — Choose the risks that concern you, add your own, and say what this area covers here.
Contracts and liability — Choose the risks that concern you, add your own, and say what this area covers here.
Regulation and compliance — Choose the risks that concern you, add your own, and say what this area covers here.
Personal data protection — Choose the risks that concern you, add your own, and say what this area covers here.
Intellectual property — Choose the risks that concern you, add your own, and say what this area covers here.
Suppliers and procurement — Choose the risks that concern you, add your own, and say what this area covers here.
Customers and sales — Choose the risks that concern you, add your own, and say what this area covers here.
Stock and logistics — Choose the risks that concern you, add your own, and say what this area covers here.
Cyber security — Choose the risks that concern you, add your own, and say what this area covers here.
IT systems and tools — Choose the risks that concern you, add your own, and say what this area covers here.
Data and records — Choose the risks that concern you, add your own, and say what this area covers here.
Use of artificial intelligence — Choose the risks that concern you, add your own, and say what this area covers here.
Environment and sustainability — Choose the risks that concern you, add your own, and say what this area covers here.
Natural events and climate — Choose the risks that concern you, add your own, and say what this area covers here.
Economy and geopolitics — Choose the risks that concern you, add your own, and say what this area covers here.
Going deeper into technology — Opened by a technology area: each IT domain ticked opens its own list of risks.
Data centres and server rooms — Choose the risks that concern you, add your own, and say what this domain covers here.
Servers and operating systems — Choose the risks that concern you, add your own, and say what this domain covers here.
Virtualisation platforms — Choose the risks that concern you, add your own, and say what this domain covers here.
Storage systems — Choose the risks that concern you, add your own, and say what this domain covers here.
Backup and recovery — Choose the risks that concern you, add your own, and say what this domain covers here.
Local and campus networks — Choose the risks that concern you, add your own, and say what this domain covers here.
Wide-area links and SD-WAN — Choose the risks that concern you, add your own, and say what this domain covers here.
Wireless networks — Choose the risks that concern you, add your own, and say what this domain covers here.
Firewalls and network perimeter — Choose the risks that concern you, add your own, and say what this domain covers here.
DNS and DHCP — Choose the risks that concern you, add your own, and say what this domain covers here.
VPN and remote access — Choose the risks that concern you, add your own, and say what this domain covers here.
Voice and telecoms — Choose the risks that concern you, add your own, and say what this domain covers here.
Public cloud (IaaS and PaaS) — Choose the risks that concern you, add your own, and say what this domain covers here.
SaaS applications — Choose the risks that concern you, add your own, and say what this domain covers here.
Containers and Kubernetes — Choose the risks that concern you, add your own, and say what this domain covers here.
Identity and access management — Choose the risks that concern you, add your own, and say what this domain covers here.
Directory services (Active Directory, Entra ID) — Choose the risks that concern you, add your own, and say what this domain covers here.
Privileged access — Choose the risks that concern you, add your own, and say what this domain covers here.
Secrets, certificates and service accounts — Choose the risks that concern you, add your own, and say what this domain covers here.
Laptops and workstations — Choose the risks that concern you, add your own, and say what this domain covers here.
Mobile devices and BYOD — Choose the risks that concern you, add your own, and say what this domain covers here.
Email and collaboration — Choose the risks that concern you, add your own, and say what this domain covers here.
Printers and peripherals — Choose the risks that concern you, add your own, and say what this domain covers here.
Business applications (ERP, CRM) — Choose the risks that concern you, add your own, and say what this domain covers here.
Web applications and APIs — Choose the risks that concern you, add your own, and say what this domain covers here.
Software development — Choose the risks that concern you, add your own, and say what this domain covers here.
Build and deployment pipelines — Choose the risks that concern you, add your own, and say what this domain covers here.
Third-party and open-source components — Choose the risks that concern you, add your own, and say what this domain covers here.
Legacy and end-of-life systems — Choose the risks that concern you, add your own, and say what this domain covers here.
Databases — Choose the risks that concern you, add your own, and say what this domain covers here.
Data classification and leakage — Choose the risks that concern you, add your own, and say what this domain covers here.
Encryption and key management — Choose the risks that concern you, add your own, and say what this domain covers here.
Personal data processing — Choose the risks that concern you, add your own, and say what this domain covers here.
Data platforms and analytics — Choose the risks that concern you, add your own, and say what this domain covers here.
AI systems and models — Choose the risks that concern you, add your own, and say what this domain covers here.
Logging and security monitoring — Choose the risks that concern you, add your own, and say what this domain covers here.
Vulnerability and patch management — Choose the risks that concern you, add your own, and say what this domain covers here.
Malware and ransomware — Choose the risks that concern you, add your own, and say what this domain covers here.
Incident response — Choose the risks that concern you, add your own, and say what this domain covers here.
Security awareness — Choose the risks that concern you, add your own, and say what this domain covers here.
IT service and change management — Choose the risks that concern you, add your own, and say what this domain covers here.
Monitoring and capacity — Choose the risks that concern you, add your own, and say what this domain covers here.
Disaster recovery and IT continuity — Choose the risks that concern you, add your own, and say what this domain covers here.
IT asset management and licences — Choose the risks that concern you, add your own, and say what this domain covers here.
Automation and scripting — Choose the risks that concern you, add your own, and say what this domain covers here.
IT staff and key-person dependency — Choose the risks that concern you, add your own, and say what this domain covers here.
IT suppliers and supply chain — Choose the risks that concern you, add your own, and say what this domain covers here.
Managed service providers — Choose the risks that concern you, add your own, and say what this domain covers here.
Industrial control systems (OT/ICS) — Choose the risks that concern you, add your own, and say what this domain covers here.
IoT and connected devices — Choose the risks that concern you, add your own, and say what this domain covers here.
Payment systems (card data) — Choose the risks that concern you, add your own, and say what this domain covers here.
Medical devices and health systems — Choose the risks that concern you, add your own, and say what this domain covers here.
Branch offices and remote sites — Choose the risks that concern you, add your own, and say what this domain covers here.
Website and domain names — Choose the risks that concern you, add your own, and say what this domain covers here.
What already exists — Each risk lists the measures in place that bear on it, and past incidents become risks of recurrence.
Risk owners and context — Each risk gets the owner of its area, from these roles.
