Appearance
Enterprise Risk Register
Where to find it: Risk Management, then Risk Register (/risks).
The Risk Register is the authoritative record of the risks your organisation carries. Its business reference is RSK-YYYY-NNNN.
Connected, not automated
OrviQ connects the risk register to live assurance telemetry — failing controls, breached KRIs, active exceptions, open findings, overdue actions — and uses it to recommend that a risk be reviewed.
Risk remains a human-governed business object
Assurance signals never silently overwrite:
- Inherent risk ratings
- Residual risk ratings
- Treatment decisions
- Risk acceptance state
- Ownership
- Risk status
A degrading control produces a recommendation with a full explanation. A person decides what it means.
The reason is that a risk rating is a judgement about impact and likelihood in a business context that no telemetry contains. A control failing does not tell you whether the residual risk is now High or Critical — that depends on what the control was protecting and what else stands behind it.
Risk statuses
| Status | Meaning |
|---|---|
candidate | Identified but not yet accepted onto the register |
open | Active and untreated or partially treated |
mitigating | Treatment is in progress |
accepted | Formally accepted through governed acceptance |
closed | No longer a live risk |
dismissed | Determined not to be a risk |
Treatment strategy
| Strategy | Meaning |
|---|---|
mitigate | Reduce through controls or remediation |
avoid | Stop the activity giving rise to the risk |
transfer | Move the exposure, typically via insurance or contract |
accept | Carry the risk knowingly |
Treatment records the strategy, the details, and a target completion date.
Choosing "accept" is planning intent, not approval
Setting the treatment strategy to accept states an intention. It does not approve anything.
Governed risk acceptance requires a formal request, a business justification, a validity expiry and maker-checker approval. See Risk Acceptance.
Continuous assurance signals
Six signal dimensions are evaluated live for each risk from its connected objects:
| Signal | Source |
|---|---|
| Control degradation | Failing or degraded evidence assertions on linked controls |
| Indicator failures | Failing or errored continuous indicator results |
| KRI breaches | KRI measurements in amber or red breach |
| Active exceptions | Approved exceptions waiving linked controls or requirements |
| Open findings | Open or overdue findings, critical and high |
| Overdue actions | Action plans linked as treatment, past their due date |
Each signal returns full explainability:
| Field | Contents |
|---|---|
| Type | The signal classification |
| Source reference | The business reference of the triggering record |
| Source title | Its human-readable name |
| Severity | Critical, High or Medium |
| Detail | A deterministic explanation of the root cause |
| Timestamp | When it was observed |
So a "risk review recommended" banner is never a bare alert. It names the control, the indicator or the finding that caused it.
Connected scope and controls
Risks link to:
| Category | Objects |
|---|---|
| Scope | Assets, business services, third parties, third-party engagements, departments, legal entities |
| Assurance | Controls, continuous indicators, KRIs, exceptions, findings, action plans |
Unlinking is non-destructive: the link is retired with a timestamp and an actor rather than deleted, so historical connections remain reconstructable.
Snapshots
Risk assessments and signal states are preserved in append-only snapshots, capturing the ratings, treatment strategy, active signals and review recommendation at a point in time.
This is what lets you answer "what did the register say at year end?" without relying on an exported spreadsheet.
Common tasks
Raise a risk
Create the risk, set inherent rating, owner and category. Requires risk.create.
Link a risk to its controls
Use the connected panel to link controls, indicators and KRIs. Links drive the assurance signals.
Record a treatment plan
Set the strategy, the details and a target date. Requires risk.update.
Review a risk with signals
Open the risk, expand the signal drilldown, and read the explanations. Then decide — the platform will not decide for you.
Request risk acceptance
See Risk Acceptance. Requires the governed workflow.
Promote a residual risk from a finding
An escalated finding's residual risk can be promoted to the register by the compliance authority. Requires risk.promote — deliberately reserved so the register reflects deliberate decisions rather than every finding.
Permissions
| Action | Permission |
|---|---|
| View the register | risk.read |
| Raise risks | risk.create |
| Edit risk records | risk.update |
| Approve risk treatments | risk.approve |
| Assign risk ownership | risk.assign |
| Promote escalated findings to the register | risk.promote |
| Formally accept residual risk | risk.accept |
| Configure methodology and run the derivation sweep | risk.methodology_manage |
All require the risk_management entitlement.
Example
Risk RSK-2026-0014 — Unauthorised privileged access to core banking systems.
| Field | Value |
|---|---|
| Inherent rating | Critical |
| Residual rating | Medium |
| Owner | Head of IT Security |
| Treatment strategy | mitigate |
| Status | mitigating |
| Linked controls | CTL-2026-0041 MFA, CTL-2026-0044 PAM, CTL-2026-0067 Access Review |
| Linked KRI | Privileged accounts without MFA |
| Linked scope | SCP-2026-0012 Privileged Accounts, core banking business service |
Signals raised in March:
| Signal | Detail |
|---|---|
| Indicator failure — High | IND-2026-0009 MFA enforcement failed: 3 of 214 privileged accounts without MFA |
| KRI breach — Medium | Privileged accounts without MFA: 3, amber threshold 1 |
| Open finding — High | FND-2026-0071 open 34 days, three accounts pending remediation |
Banner: Risk review recommended — 3 active signals.
What the Risk Manager did: reviewed the drilldown, confirmed the three accounts were service accounts in a decommissioning programme, left the residual rating at Medium, and recorded a review note explaining why. The signals remain visible until the underlying records clear.
What the platform did not do: raise the residual rating to High on its own.
That is the intended behaviour. Three service accounts on a decommissioning path is a genuinely different situation from three live administrator accounts, and only a person knows which one this is.
Troubleshooting
"A risk shows signals I cannot explain." Expand the drilldown. Every signal names its source record and gives a deterministic reason.
"I unlinked a control but the signal persists." Unlinking is soft-retire and takes effect on the next evaluation. Check the link status.
"The residual rating did not change after a control failed." Correct. Ratings are human judgements. The signal recommends review; it does not rerate.
"I cannot accept a risk." Setting the treatment strategy to accept is not acceptance. Use the governed acceptance workflow, which requires risk.accept and independent approval.
"Risk Register is not visible." Requires the risk_management entitlement and risk.read.