Skip to main content
Menu

Independent reference · IT risk governance

Understand your IT risks before they become business problems.

A risk register is only useful if it changes what you do next. This is how to score IT risk consistently, choose treatments, and show your working to a board, an auditor or an insurer.

Open the risk matrix tool Contact IT Risk Guide

An example risk landscape: five controls bring five risks inside the risk appetite line An illustrative contour map. Likelihood runs left to right and impact runs upward, so exposure rises toward the top right. Five example risks start in the high-exposure terrain, joined by lines that show how they depend on one another. One control is applied to each risk in turn: multi-factor sign-in to R1, a quarterly access review to R2, a supplier exit plan to R3, a scheduled restore test to R4 and full-disk encryption to R5. Each risk then sits inside the example risk appetite line, with a dotted outline left where it began. The data is invented for illustration and measures no real system.
  1. R1 Exposed remote access C1 Multi-factor sign-in
  2. R2 Stale admin accounts C2 Quarterly access review
  3. R3 Supplier outage C3 Supplier exit plan
  4. R4 Untested restores C4 Scheduled restore test
  5. R5 Unencrypted laptops C5 Full-disk encryption
Illustrative example, not a measurement of any real system: the risks, positions and controls are invented. Contours follow likelihood × impact; every risk ends inside the appetite line.

IT Risk Guide publishes method and tools. It does not audit, assess, certify or attest to anyone’s systems, and has no affiliation with any standards body or framework owner.

01 · Method

Show the arithmetic, then argue about the inputs

Most disputes about a risk register are really disputes about how a number was reached. The method used here is deliberately small enough to state in one table.

Every risk gets a likelihood and an impact from 1 to 4. The score is the product, banded into four steps. Ranking is by score, with ties broken by impact. That is the whole method, and the scoring guide is equally direct about where multiplying ordinal scales misleads you.

The 4 × 4 scale used by the tool and the examples
ScoreBandReached by
1–3LOW1×1, 1×2, 1×3, 2×1, 3×1
4–6MEDIUM1×4, 2×2, 2×3, 3×2, 4×1
8–9HIGH2×4, 3×3, 4×2
12–16CRITICAL3×4, 4×3, 4×4

02 · Governance architecture

Every risk should trace to a control, and every control to evidence

Boards, auditors and insurers ask the same questions in the same order. A register entry is defensible when each link in the chain can be shown, not merely claimed.

  1. RiskR1Exposed remote accessRemote sign-in relies on passwords alone.
    ControlC1Multi-factor sign-in on remote accessA control that lowers the likelihood.
    EvidenceE1Enrolment report and policy settingDated, exported, kept with the register.
    DecisionD1Risk owner reviews residual riskAccept it, or treat further.
  2. RiskR2Stale admin accountsLeavers and movers keep privilege.
    ControlC2Quarterly privileged-access reviewDesigned so a manager can complete it.
    EvidenceE2Signed review logRemovals tied to tickets.
    DecisionD2Summarised for the boardOne line that asks for a decision.
  3. RiskR4Untested restoresBackups exist; recovery is unproven.
    ControlC4Scheduled restore testRun against a real system, to a plan.
    EvidenceE4No test record on fileThe control exists, but nothing shows that it operates.
    DecisionD4Not yet defensibleAn auditor would treat it as unevidenced.

Illustrative example threads. The names and outcomes are invented to show the structure and are not findings about any organisation. See risk treatment, audit preparation and board reporting.

03 · The guides

The working guides

Each guide is written for the person who has to produce the artefact, not for the person who wants a definition.

  1. 01The IT risk registerWhat a register entry must contain to be actionable, who owns it, and how to stop it going stale.
  2. 02Risk scoringQualitative against semi-quantitative scoring, written-out definitions, and the ordinal-scale traps.
  3. 03Vendor and third-party riskTiering suppliers, reading assurance reports, and the contract terms that matter at exit.
  4. 04Access reviewsDesigning a review a manager can actually do, and producing evidence an auditor will accept.
  5. 05Risk treatment and residual riskMitigate, transfer, avoid or accept, and how to record each decision so it can be defended.
  6. 06Audit preparationEvidence, populations, sampling and the difference between a control that exists and one that operates.
  7. 07Board reportingOne page that asks for decisions instead of displaying a heat map.

04 · The tool

Score your own register

Enter named risks with a likelihood and an impact. The tool scores them on the method above, plots them on the matrix, ranks them, suggests treatment options and produces a summary you can paste into a register. It runs in your browser and sends nothing anywhere. The output is a working estimate: it is not a certification, an audit or evidence of compliance.

Open the risk matrix tool