create-a-risk-register

# create-a-risk-register Describe uncertain future events separately from active issues. Use the register to drive treatment and escalation, not to collect vague worries. ## Procedure 1. Confirm scope, objectives, time horizon, risk authority, review cadence, and impact categories. 2. Gather risks from plans, assumptions, dependencies, incidents, contracts, data, operators, and affected stakeholders. 3. Write each risk as cause, uncertain event, and consequence. 4. Link evidence, affected objective, exposure window, current controls, and control confidence. 5. Score likelihood and impact with defined scales; record uncertainty rather than false precision. 6. Assign one risk owner and a treatment choice: avoid, reduce, transfer, accept, investigate, or exploit. 7. Define actions, due dates, residual exposure, leading indicators, trigger thresholds, and contingency. 8. Escalate risks beyond tolerance to the authority that can accept or fund treatment. 9. Review changes, close expired risks with evidence, and convert realized risks into issues without deleting history. ## Failure plan - Do not label active defects or guaranteed commitments as risks. - Never reduce a material safety, legal, security, privacy, or financial exposure to a color without detail. - If scoring hides catastrophic low-frequency harm, show the impact explicitly. - Do not let an unowned treatment create the appearance of control. ## Done - Material risks have evidence, exposure, controls, owners, treatments, triggers, and contingencies - Acceptance and escalation match documented authority and tolerance - Review history, realized issues, and closed risks are traceable