The risk register

  • 4:50
  • Concept
  • Narrated by Sekura
  • English
  • Updated Oct 2026

TranscriptClick a line to jump there

What Sekura says

0:00In this lesson you'll learn how the risk register works: what a risk is, how its score is worked out, how controls connect to it, and how you turn a decision into actions.0:12First, what is a risk? It's something that could go wrong for the company: a weakness that could be exploited, and the damage it would do. The risk register lists them, so you can decide what to tackle first.0:25How big is a risk? You rate two things from one to five: its Likelihood, how likely it is to happen, and its Impact, how bad it would be. Multiply them and you get the Risk score, from one to twenty-five.0:41The score sets the rating. By default, twenty or more is Critical, twelve to nineteen is High, six to eleven is Medium, and below six is Low.0:52You can move those cut-offs for each company: edit it from Clients and look for Risk bands.0:58Let's open it. With the company selected, open Risk Management in the sidebar, then Risk Register. Each row shows the risk, its Score as a bar, its Rating and its Status.1:11One word to watch: Owner. Here it means the person or third party at the company who answers for the risk, picked from its Assets, not from the people on your team.1:23Click a row to open the risk.1:26The detail opens on the right. It starts with Likelihood × Impact: the two ratings, the score, and a small matrix that shows where the risk sits.1:37Below the description are the linked controls: the protections that reduce this risk. Each shows its latest evaluation for this company, such as Pass or Gap, or Not evaluated if no gap analysis has graded it. That tells you whether the protection is in place.1:55Then decide the Treatment. Mitigate: reduce it with controls and actions. Transfer: pass it to someone else, like an insurer or a supplier. Accept: live with it, and record why. Avoid: stop the activity that causes it. Until you choose, it stays Undecided. One click saves your choice.2:18To plan the work, click Edit risk at the foot of the risk.2:22Scroll to Recommended actions. Click Add action, say what needs to be done and how much Effort it takes, then Save changes.2:31Every action lands on Actions, just below the register in the sidebar: the actions of all the company's risks, in one place.2:41Click an action to open it.2:43The pane shows its status, phase, effort, owner and target date. To change any of them, click Edit.2:51Set its Owner, its Target date and its Phase, from Short term to Long term, then click Save.2:58Track each action from Pending to In progress to Done. The counters at the top add them up.3:05Under Display, switch to Board to drag cards between columns.3:10Here's R-02 at the example company, Acme: backups never tested with a full restore. Likelihood three, impact five. Three times five is fifteen, so it's High.3:23Tip. A tip: R-02's impact is the maximum, five, yet it isn't critical. You can't set a rating by hand. If one looks wrong, revisit the likelihood or the impact.3:36R-02 is linked to A.8.13, Information backup, from ISO 27001's Annex A. It reads Partial: Acme's Annex A gap analysis found that backups run, but a full restore has never been tested. That state comes from a compliance analysis; a readiness never sets it.3:59R-02's treatment is already Mitigate, and its owner is Javier Ortega, Acme's IT lead. Under Recommended actions is its one action: run a full restore test of the ERP backup, effort Low.4:13When the restore test succeeds, edit the action, set its Status to Done and click Save.4:20Then, on the risk, click Mark mitigated.4:24To recap. A risk is something that could go wrong. Its score is likelihood times impact, and the score sets the rating. Linked controls show whether the protection is in place. And the treatment and its actions turn the register into a plan.4:41Thanks for watching! For more GRC lessons, visit our Learning Center at sekit.ai/learn-center.

Chapters

You'll learn

  • What a risk is, and how its score is worked out
  • How controls connect to a risk
  • The four ways to treat a risk
  • How actions turn a decision into work

Try it

Do it yourself, in 3 minutes

Start a free trial. Sample data is already loaded, and the tour opens on this exact screen.

Start free trialAlready a customer? Open in Sekit

Key terms

Risk
Something that could go wrong for the company, rated by how likely and how bad.
Risk score
Likelihood times impact, each from 1 to 5. From 1 to 25.
Treatment
What you decide to do about a risk. Mitigate, transfer, accept or avoid.