Scenario and context
Risk ID, title, cause-event-consequence statement, business area, category, and affected objective.
Operational risk register
Start with a risk register that leads to a decision
Use a populated register for people, process, system, supplier, safety, privacy, and finance scenarios—then connect controls, treatment, findings, and review when a flat sheet is no longer enough.
The live Jodoo register is the primary asset. Export data when needed while keeping the working register at the center.
Start with Jodoo’s Free plan for up to five users. No credit card required.
- Seven sample risks across normal, treatment, acceptance, controlled, and closed states
- Fields for inherent and residual exposure, owner, response, next review, and decision
- Connected controls, findings, actions, and approval history
42 linked sample recordsCurrent, due, overdue, failed, blocked, returned, accepted, verified, and retired states.Adapt after installationChange fields, routes, role views, reminders, and dashboards without rebuilding the App.
- 01Describe the scenario
- 02Assign the owner
- 03Assess impact and likelihood
- 04Choose a response
- 05Track treatment
- 06Review residual risk
Give every column a decision purpose
More fields do not make a better register. Keep the context needed to assess, act, and review.
Assessment
Impact, likelihood, inherent score, criteria used, assumptions, and assessment date.
Response
Strategy, owner, controls, treatment, due dates, dependencies, and current state.
Residual review
Remaining exposure, evidence, reviewer, decision, expiry, next review, and closure or reopen history.
Load difficult states before adopting the register
A clean sheet demonstrates formatting; a populated register demonstrates the operating model.
High residual risk
Privileged-access drift is awaiting a named decision and time-bound action.
Treatment in progress
Payment failover and manual-handling risks have actions and verification still open.
Third-party dependency
Supplier resilience evidence is incomplete and owned follow-up remains visible.
Controlled and closed
Payment control evidence and a retired process show how verified outcomes differ from open work.
Review when the evidence changes—not only at year end
Use event-driven and scheduled review together.
Scheduled review
Refresh assumptions, controls, treatment, residual rating, and the next date.
Event-triggered review
Reassess after an incident, failed test, supplier change, control retirement, or major process change.
Decision review
Expire time-bound acceptances and reopen risks when treatment or evidence no longer supports closure.
Preserve the register; remove the reconciliation
Move when reminders, evidence, actions, permissions, and dashboards require manual merging.
Import the facts
Keep stable IDs, owners, scoring definitions, response, treatment, and review dates.
Create connected records
Separate controls, findings, actions, evidence, and decisions so each has its own owner and lifecycle.
Pilot one portfolio
Test difficult states and one administrator change before expanding access.
Operational risk register · Practical questions
What columns should an operational risk register include?+
Use stable ID, scenario, area, category, cause, event, consequence, impact, likelihood, inherent rating, owner, response, controls, treatment, due dates, residual rating, review date, decision, and status.
What is the difference between inherent and residual risk?+
Inherent risk is exposure before considering current controls. Residual risk is the remaining exposure after evaluating controls and treatment evidence.
Should findings and actions stay in the register row?+
Only very simple registers can do that safely. Connected finding and action records preserve separate owners, states, due dates, evidence, verification, and history.
How often should the register be reviewed?+
Use a risk-based schedule plus event-triggered review after incidents, failed controls, material supplier or process changes, expiring exceptions, and completed treatment.
When should a risk register move beyond a spreadsheet?+
Move when multiple owners, role permissions, reminders, linked evidence, findings, actions, approval, dashboards, or change history require manual reconciliation.
Try the complete workflow
Use the operational risk registerInstall the populated register before redesigning your process
Work through high, blocked, pending, controlled, and closed examples, then adapt the fields and review route to your business.