Minimum risk-register structure
- Risk category and event
- Cause and potential consequence
- Inherent likelihood and impact
- Existing controls and evidence
- Residual likelihood and impact
- Owner, action and due date
- Decision treatment: inform, condition or block
Assess inherent risk before considering controls
Inherent risk describes the exposure if existing controls are ignored. This creates a consistent baseline and helps distinguish a low-risk event from a high-risk event that is currently well controlled.
Describe controls and their evidence
A control is not simply a promise. Record what the control is, who operates it, what evidence supports it and whether the evidence is current. A proposed future action should not automatically be treated as an existing control.
Residual risk is the remaining exposure
Residual risk is assessed after considering the effectiveness of existing controls. It should remain visible in the supplier comparison. A penalty can be applied to an adjusted score, but the underlying risk and action should still be readable.
Connect risk to award treatment
- Inform
- The risk is accepted or monitored and does not require a pre-award condition.
- Condition
- The award may proceed only if a named action is completed by an owner and deadline.
- Block
- The risk or failure is outside the approved tolerance and prevents a positive recommendation.
Fictional example
A supplier relies on a single production line. The inherent continuity risk is high. The supplier provides a tested recovery plan and an alternate subcontracting arrangement, reducing residual exposure to medium. Management may accept the risk with conditions, but the recommendation should state the remaining exposure, owner and monitoring action.