Item 02Risks & controls

A risk register your auditors will want to read.

Structured scoring, living heat maps and a controls library with its own reviews, incidents and actions.

Kestrel Vale Housing

Strategic Risk Register

13 risks · reviewed quarterly · Audit & Risk Committee

Heat map+ Add Risk

Likelihood ↑ · Impact →

1–6 8–12 15–25

Risk	Inh.	Res.	Review
R-07 Rent arrears rise beyond plan	20	12	Due 2 Nov
R-12 Cyber attack via supplier	20	8	Reviewed
R-03 Damp and mould non-compliance	16	9	Overdue 4d
R-15 Development cost inflation	12	6	Reviewed

2.1Three-tier assessment

Where you are, where your controls take you, where you want to be.

Every risk is scored impact times likelihood, 1 to 5, at every tier.

The raw risk, before any controls.

What remains with controls in place.

Where you want to be. Optional.

One scale everywhere: The same scoring in every register, so movement is evidence, not opinion.
Living heat maps: Inherent and residual positions on an interactive 5 × 5 map.
Review discipline: Each register sets how often its risks are reviewed. Overdue reviews are flagged.
Access per register: Sensitive registers stay with the people who should see them.

Fig. 2.1One risk, three tiers, and the controls that move it

2.2The controls library

Controls are records with owners, reviews, incidents and actions of their own.

Fig. 2.2A control: its effectiveness, its risks, an incident it detected

One control, many risks: Change the control once and every linked risk sees it.
Effectiveness, your way: A single RAG rating, or design and operating effectiveness rated separately.
Incidents feed back: Record whether a control failed, mitigated, detected or was bypassed.

2.3Evidence

History is kept at the level of the field, and each risk stays tied to its meetings, objectives and metrics.

Field-level audit trail: Who, when, the field, and the old and new value. Append-only.
Relationship graph: See what else a risk touches, from controls and objectives to meetings.
Reports on a schedule: Risk change, heat map migration and review discipline, before the committee meets.

R-12 · Audit history

When	Who	Field	Change
12 Oct 14:02	Priya Shah	Residual likelihood	3→2
12 Oct 14:02	Priya Shah	Residual score	12→8
12 Oct 13:58	Priya Shah	Linked control	—→C-17
30 Sep 09:41	Tom Bennett	Review date	30 Jun→30 Sep
30 Sep 09:40	Tom Bennett	Owner	E. Hart→T. Bennett

Append-only. Entries are written by the server and cannot be edited or deleted from the interface.

Fig. 2.3Audit history for a risk, field by field

2.4Specification

Every feature, for the people doing the due diligence.

Scoring and registers7 features

One scale: Impact and likelihood are each scored 1 to 5 and multiplied, at every tier, in every register. Movement between tiers is evidence, not opinion.
Multiple registers: Strategic, operational, project or committee registers, each with its own owner, colour, review frequency and access list.
Heat maps: Inherent and residual positions on an interactive 5 × 5 map per register. Filter by category or owner and drill into the cell.
Categories and causes: Your own risk and control categories, and a library of standard causes alongside the organisation's own, so analysis is comparable across registers.
Implications: Record what the risk would mean if it crystallised, so the score is explained rather than asserted.
Review discipline: Each register sets how often its risks must be reviewed. Overdue reviews are flagged on the register, and reported on.
Register-level access: Who can view, edit or manage each register is set independently. Sensitive registers stay with the people who should see them.

Controls7 features

One control, many risks: Controls live in a central library and link to as many risks as they mitigate. Change the control once and every risk sees it.
Effectiveness, your way: Choose a single RAG rating per control, or a split model that rates design effectiveness and operating effectiveness separately. Set once for the organisation.
Reviews with history: Each control review is recorded with its rating, reviewer and notes, so the trend in effectiveness is visible.
Control attributes: Type, frequency, whether it is automated, the line of assurance it belongs to, and the owner responsible.
Incidents: Incidents are recorded against risks and linked to controls with a role: the control failed, mitigated, detected or was bypassed. That is the feedback loop into effectiveness.
Remediation actions: Actions can be raised directly on a control, so remediation sits with the thing being remediated.
Controls and metrics: A control can be linked to the performance metrics it supports, answering which controls stand behind an objective.

Evidence6 features

Field-level audit trail: Every change to a risk, control or action is logged with who, when, the field and the old and new value. Append-only.
Soft delete and restore: Deleted risks are not destroyed. Restore them with their full history intact.
Relationship graph: An interactive map of how risks, controls, objectives, metrics, incidents, actions and meetings connect, for the question “what else does this touch?”
Linked to meetings: Agenda items link to risks, so the board discusses the register in context and actions flow back to it.
Linked to objectives and metrics: Risks link to the objectives they threaten and the metrics they would move, so exposure can be reported by objective.
Reports: Risk change, risk activity, heat map migration, review discipline, objective exposure, and full register and controls exports. Scheduled or on demand.