Build a risk register that supports decisions
Connect each risk to an objective, accountable owner, control evidence and a decision that someone can act on.
Read guideRisk topic hub
Risk management guidance and registers for UK teams
Risk management connects objectives to uncertainty, decisions and evidence. Describe the cause, event and consequence, assess the exposure, identify controls, and record the treatment and accountable owner. Review the assessment when circumstances or evidence change.
Start with the right scope
HM Treasury’s Orange Book sets out the government risk-management framework. Its stated audience includes central-government departments and relevant arm’s-length bodies. Other organisations may adapt useful principles, but should not describe them as a universal private-sector legal duty.
HM Treasury: Orange Book, scope and principles. Source reference baseline: 1 November 2026. AI-assisted preparation; no independent human legal review is claimed.
01
Name the objective
Write a specific cause, risk event and consequence for the service or activity.
02
Assess the controls
Record operation, ownership, evidence, limitations and the rationale for residual risk.
03
Choose and review treatment
Assign actions, acceptance authority, review triggers and a working target date.
Risk guides
Follow the question through its scope, evidence and next step.
Test controls and keep an evidence trail
Distinguish a policy being written from a control being designed well and operating consistently.
Read guideReview suppliers across the whole relationship
Prioritise critical dependencies, ask for relevant evidence, and plan monitoring and exit before a supplier fails.
Read guidePractise disruption before it becomes a crisis
Use a focused scenario to test decisions, dependencies and recovery assumptions, then track the lessons to completion.
Read guideBring cyber risk into the board's decisions
Translate technical reporting into business exposure, accountable decisions and evidence of resilience.
Read guideAn illustrative working example
A fictional service team depends on one supplier for appointment data. It records the risk of an outage interrupting bookings. A backup contract exists, but a restore test has not been completed. The team keeps the evidence gap visible, assigns the test, and explains why the contract alone does not justify reducing the residual risk. The example illustrates a method, not measured performance.
Fictional example created to explain the method. It is not client work, original empirical research or an assurance conclusion.
Keep a useful working record
Browser-local risk register gives you a practical place to record your own scope and evidence. Use the connected review workspace when you need to link risks, controls, obligations and actions.
Is a risk matrix a complete risk assessment?
No. A matrix is a discussion aid. Record the scale definitions, assumptions, uncertainty, evidence and consequences as well as the score. A number does not establish that a risk is acceptable.
What is the difference between inherent and residual risk?
Inherent risk describes the exposure before the controls under consideration. Residual risk describes the assessed exposure after them. Explain which controls affect the assessment and what evidence supports the change.
Related implementation briefings
- Operational resilience after the transition deadline
- NCSC highlights how cyber incident sharing can meet market disclosure duties
Connect the disciplines
Read the GRC framework overview and worked example, then use the other topic hubs to connect the responsibility, exposure and requirement.