Read with the right scope
A practical method for organisations of different sizes. HM Treasury's Orange Book applies to central government departments and relevant public bodies; it is a useful benchmark, not a general statutory requirement for private businesses.
Status: Practical guidance · official sources checked 1 November 2026
Start with the objective
A useful register explains what could prevent an objective being achieved. The Orange Book places risk management within planning, governance and decision making. Begin with the services, commitments and outcomes that matter to your organisation, then ask what uncertainty could affect them. A list of broad labels such as 'cyber' or 'reputation' leaves the decision maker with too little to assess.
The working method below is an editorial starting point. Adapt its terminology, scoring and review frequency to your organisation, sector obligations and existing framework. A completed register does not establish compliance or prove that a control works.
Describe a specific risk
Use a cause, event and consequence. For example: because payment instructions can be changed without independent confirmation, a fraudulent bank-detail request could be accepted, causing loss and delayed supplier payment. Record the affected objective, process and people. Separate this prospective risk from an incident that has already happened.
- Give the risk a stable reference and one accountable owner with authority to escalate it.
- Record the existing controls and identify where evidence of their operation can be found.
- Describe the uncertainty behind the assessment, including missing information and dependencies.
- State the next decision: accept within authority, improve a control, avoid the activity or obtain further evidence.
Use scores with judgement
If you use a likelihood-and-impact matrix, define each level and the time horizon first. A 1–5 scale is an optional working convention; it is not a universal legal requirement. Explain what your framework means by inherent risk, residual risk and target risk. A planned control belongs in the target assessment until it has been implemented and checked.
NCSC guidance cautions against reading risk numbers in isolation. Keep the narrative beside the score. A lower number should have an explanation: what changed, what evidence supports it, and what remains uncertain? An unchanged score can still conceal a deteriorating dependency or a near miss.
Make the next review useful
At review, compare the current position with the previous decision. Check overdue actions, changes to exposure, incidents and control exceptions. Escalate risks beyond agreed authority or appetite rather than repeatedly extending deadlines. Close an action only when its completion criteria are met, retaining the evidence and any residual concern.
- Working record: risk reference, objective, cause-event-consequence, owner, assessment rationale, controls, evidence references, action owner, due date, decision and next review.
- Review trigger examples: a new supplier, service change, incident, missed control, regulatory change or a material shift in the business plan.
Put the guide to work
Start with the evidence.
- The objective and a specific cause–event–consequence description.
- Defined rating scales, time horizon and the reasoning behind the assessment.
- References showing current controls operating before a residual score is reduced.
- A treatment or acceptance decision with authority, next action and review trigger.
Your first three steps
- Replace one broad label, such as ‘cyber’, with a specific event affecting a named service.
- Identify the controls already operating and separate them from planned improvements.
- Record the next decision and explain any difference between inherent, residual and target exposure.
Common gaps to look for
- Scores lack defined scales or a time horizon.
- A planned control is used to reduce the current residual score.
- The register is updated without changing a decision or action.
Review when: Reassess after a near miss, missed control, new dependency or change that undermines the recorded assumptions.
Suggested working method. Apply the source requirements and scope explained in this guide.
Part of the risk guidance hub. See how the GRC framework connects the disciplines.
Connect this to your review
Link the risk, control, obligation and next action in the review workspace. Record what is known, what needs checking and which decision follows. The workspace organises your records; it does not inspect or independently verify evidence.
Sources & verification
- HM Treasury — The Orange Book: Management of Risk ↗Source checked 1 November 2026 · Primary source
- NCSC — Risk management for cyber security ↗Source checked 1 November 2026 · Primary source
The source list records when each reference was checked. AI-assisted research and drafting; no independent human legal review is claimed. Check for later changes and advice appropriate to your circumstances.