Role
Risk management
How do you know your risk register describes today's company? If you last updated it at the previous board review, it describes the company of a year ago.
Intro call
Four questions we would start with
How do you know the risk register is current?
If the only moment of updating is a workshop once a year, then between workshops the register is a historical document.
When is an action to reduce a risk decided?
At a review, or once the risk has already materialised. That distinction decides whether the risk function makes sense.
What is left after a risk workshop once its participants leave?
If it is a list with no reasoning and no actions assigned, the next workshop starts from zero.
Which kind of event recurs most often?
Events that have already happened are the cheapest source of knowledge about risk - provided somebody brings them together.
We take over keeping the register, you keep the risk assessment
Collecting signals, maintaining the register, chasing the actions and preparing the reports can be taken off the desk. Judging likelihood and impact stays with a person.
- The register updates from signals, not only from workshops. - Events, complaints, breakdowns and audit findings feed the picture of risk between reviews.
- A risk has an action and an owner assigned. - An entry with no action is visible as an entry with no action, not as a line in a table.
- The assessment stays subjective, but stops being unjustified. - We record what the assessment rests on, so that at the next review it can be challenged or confirmed.
Scope
What can be taken off risk management
Eighteen example tasks. Each one has a human approval point. Below is a selection, and the scope we fit to your risk model.
Identifying risks
- Collecting signals from events, audits and complaints
- A proposed new entry in the register (decision: the specialist)
- Linking a risk to a process and an owner
- Pointing out areas with no risks identified
Assessment and priorities
- A register of assessments with the reasoning and the date
- Comparing an assessment with the history of events in that area
- A signal about a risk assessed long ago and never verified
- Risks set out by priority (decision: the specialist)
Mitigating actions
- Assigning an action to a risk with a date and an owner
- Pointing out risks with no action assigned
- A reminder about an action approaching its date
- Judging whether an action changed the level of risk (assessment: the specialist)
Monitoring signals
- Early warning indicators by risk
- A signal when a threshold value is crossed
- Events that may indicate materialisation, set out
The report for the board
- A draft report from the register and the actions (approval: the specialist)
- The changes in the register since the previous review
- The risks needing a board decision, set out
A day's work
Today
- You update the register before a review, collecting the data by email
- The assessments rest on a workshop from a year ago, with no recorded reasoning
- You chase the actions assigned to risks with reminders
- You do not know which risks have no action at all
- Events in the company do not reach the register
- You assemble the board report by hand over several days
With AI assistance
- The register is fed by signals from events and findings
- An assessment has its reasoning and date recorded, so it can be verified
- The actions have an owner, a date and a reminder
- Risks with no action are pointed out
- Events in the company are summarised by type
- The report comes from the register, you supply the conclusions
- A current register
the register describes today's company
signals feed it between reviews
- Risks linked to actions
fewer entries with no response at all
a missing action is visible as missing
- Signals before materialisation
a risk materialising can be visible earlier
threshold indicators are monitored
- A basis for board decisions
the review is about the changes rather than about reconstructing the list
the report comes from the register as you go
We start with linking risks to actions, because it shows fastest where the register is dead.
- Step 1
A register with owners and actions
Every risk with a process, an owner and an action, or with the absence of an action made explicit.
- Step 2
Signals from events
Events, complaints, breakdowns and audit findings feeding the register.
- Step 3
Early warning indicators
Thresholds and signals for the risks that can be measured.
- Step 4
The report for the board
The changes since the last review and the risks needing a decision. Last, because it needs a living register.
Common questions
Questions that come up at the first meeting
How is this different from internal audit and compliance?
Audit checks whether what was agreed is being done. Compliance watches conformity with obligations. Risk deals with what can happen although it has not happened yet - which is why it is the only one of the three that works without hard evidence.
Will this role survive if the register updates itself?
The register updates from signals, but judging likelihood and impact is a judgement - and that judgement is this role. We take over the collecting, the chasing of actions and the assembling of the report for a review. A specialist who is not spending two weeks preparing material works on the risks nobody has named yet.
Does this fall under the AI Act?
Risk management is not a high-risk use. The only point needing care is that signals about events do not add up to an assessment of the people accountable for areas - we keep the register by process rather than by person.
Still have a question that is not here? Book a call
Next step
How many entries in your risk register have no action assigned?
We will show you what risk management looks like when the register is fed by events and an assessment has its reasoning recorded.