A risk register is a decision queue, not a museum
Entries should be waiting for a decision, not preserved for display.
If something has been amber for three years, either it is acceptable, in which case accept it formally and remove it, or it is not, in which case somebody needs to act. Keeping it open indefinitely is a way of avoiding both. A register should shrink as well as grow.
More on Governance and risk
- 'compliance means secure'Certified, and propped open
- Risk is about uncertain impact, not merely bad thingsWhere it might land
- Risk acceptance spends organisational toleranceSigned, and spent
- Control effectiveness is separate from control existenceTicked, and still empty
- Risk owners need authority over the consequenceThe name, not the lever
- Risk aggregation can reveal concentrationAll on one leg