A risk register reviewed quarterly and refreshed annually is already obsolete. Here is how leading organisations are making risk dynamic.
There is a particular kind of risk register entry that tells you everything about an organisation's risk maturity: score 12, amber, controls listed as 'monitoring', last reviewed fourteen months ago. It is risk management as theatre — the form preserved, the function abandoned.
The organisations doing this well have made three shifts. First, ownership: every risk has a named senior owner whose objectives include its management, not a committee that collectively notes it. Second, scoring honesty: a risk that has sat at 12 for two years is either not a risk or not being managed, and either answer demands action.
Movement is the metric
Third — and most important — they measure movement rather than position. A register in which risks are opened, escalated, de-escalated and closed is healthy, even if the aggregate score is high. A static register with comfortable scores is the dangerous one. Boards should be asking a simple question each quarter: what changed, and why?
Technology helps, but only after the discipline exists. We have seen excellent registers in spreadsheets and dreadful ones in expensive platforms. Buy the software last; build the behaviour first.
