Template preview · Operations
Enterprise risk register
Make material risks, controls, and owners visible for review.
A risk register for a fictional organization.
Sample purpose
Make material risks, controls, and owners visible for review.
Audience: Risk manager, Executive- Structure
- 4 sections
- Criteria
- 12
- Sources
- 6
- Watches
- 4
- Default approach
- Review first
Set the purpose first. Then change every section, criterion, and agent setting before anything runs.
Fictional sample
Structure and criteria
Sample content shows the shape of a useful document. Copying it is optional.
01 Review firstRisk statements
For this enterprise risk register, states cause, uncertain event, and possible impact.
Criteria
- Each risk states cause, uncertain event and impact, not a category like operational risk.
- Impact is in service terms, such as intake paused one business day.
- At least one risk is checked against a real external incident or advisory.
Sources
- CISA known exploited vulnerabilities cisa.govReal exploited-vulnerability entries for vendor and IT risks.
- NIST SP 800-30 risk assessments csrc.nist.govRisk statement structure.
- Summit incident summaries (fictional) api.summit-civic.examplePast internal incidents by domain.
Watches
- Checks cisa.gov weekly
Sample content
Risk event Cause Impact Owner Residual score Vendor outage Single permit-hosting provider Intake paused for one business day Mira Patel 3 x 4 = 12 Staffing gap Two coordinators share review queue Backlog exceeds 40 cases Jon Bell 2 x 3 = 6 02 Review firstExposure and controls
For this enterprise risk register, rates inherent and residual exposure against stated scale.
Criteria
- Inherent and residual scores use one stated scale, such as likelihood 1 to 4 times impact 1 to 4.
- Each control carries current evidence with a date, such as restore tested Oct 1.
- Each gap says what is missing, such as second role not cross-trained.
Sources
- NIST SP 800-53A control assessment csrc.nist.govHow to test control effectiveness.
Watches
- Follows Risk statements
Sample content
Control Evidence Gap Weekly permit export Oct 1 export completed Restore not yet tested Cross-trained backup One backup trained Second role still uncovered 03 ManualTreatment decisions
For this enterprise risk register, assigns treatment, control owner, and due date.
Criteria
- Each treatment has an owner with authority to fund or accept it.
- Each has a specific due date and named completion evidence.
- Acceptance is conditional, such as accept residual 12 only after the continuity test passes.
Sources
- Summit approval thresholds (fictional) api.summit-civic.exampleSpend and acceptance authority by role.
Watches
- Follows Exposure and controls
Sample content
- ☐ Mira schedules a restore test by Oct 20, 2026
- ☐ Jon names a second queue backup before Nov 1, 2026
- ☐ Accept residual score 12 only after continuity test
04 Review firstRisk review
For this enterprise risk register, records changed exposure and acceptance authority.
Criteria
- Shows review date, next date and whether the cadence was met.
- Each score change is explained by the evidence that moved it.
- Controls without current evidence get an owner and due date.
Sources
- Summit review schedule (fictional) api.summit-civic.examplePast and upcoming review dates.
Watches
- Follows Treatment decisions
Sample content
- Highest residual risk
- 12 / 25
- Controls with current evidence
- 1 of 2
- Next risk review
- Nov 2, 2026