Turn your risk register into owned actions and escalation

A risk register earns its place in an operating meeting when it helps someone decide what to do. Start with the objective at risk, describe what could happen and identify the control that would change the outcome. Then assign the work and establish when the issue must reach a person with greater authority.

The UK Treasury Orange Book connects risk management with governance, decision-making and clear accountability. It also addresses escalation and confidence in controls. 1 It is UK government guidance; it is not a universal legal requirement for private companies. The following method is an original practical adaptation for business teams, with thresholds that each organisation must choose for its circumstances.

A control already operating and a future improvement action are different things. Give each a named owner and evidence. Establish escalation triggers before an incident makes the decision urgent, and do not let a colour or numerical score substitute for an explanation.

Replace broad labels such as “supplier risk” with a statement linking a cause, an uncertain event and an effect on a defined objective. For example: limited alternate capacity could make a critical supplier interruption delay customer deliveries. The statement identifies the dependency and the outcome that needs protection.

Record material assumptions. If the assessment assumes two approved alternate suppliers, confirm their ability to provide the required specification and volume. Two company names in a database do not establish usable capacity. A missing assumption should be visible in the decision, not quietly treated as a functioning control.

A working control might be a scheduled review of supplier capacity with documented exceptions and follow-up. An improvement action might be to qualify an additional supplier. Marking the qualification action complete does not prove that the ongoing capacity review operates effectively.

For each important control, record who performs it, when it operates, what evidence remains and who checks exceptions. For each action, record the deliverable, owner, due date and acceptance criteria. Ask whether the action reduces the risk described or merely improves the appearance of the register.

Identify conditions that demand attention: a critical control unavailable, an exposure beyond approved tolerance, a deadline threatening a customer commitment or repeated failure of an agreed action. Name the recipient, expected response time and deputy. The exact thresholds should reflect business needs and applicable obligations rather than a generic template.

For cross-border teams, specify the time zone and the channel used outside normal working hours. A message sent to an unattended mailbox is not an effective escalation. Test the route with a harmless exercise and correct ambiguous hand-offs.

Avoid assuming that risk scoring creates mathematical certainty. A low-likelihood event can still require immediate action when its consequence is unacceptable or a mandatory obligation applies. Explain the decision alongside any score.

Assume an exporter relies on one specialist packaging supplier and has six working days of stock. A delivery commitment is approaching, and the supplier reports an uncertain restart after equipment failure. These figures are invented for this example.

The risk owner checks available stock, customer commitments and the evidence behind the restart estimate. Procurement establishes whether an alternate can meet specifications. The operations lead decides whether to resequence production within authorised limits. If the expected shortfall exceeds those limits, the matter goes to the designated senior decision-maker with options and consequences.

“Contact supplier” would be an incomplete action because it does not state the required result. A useful action is to obtain a dated capacity confirmation, validate the alternate option and present a delivery recommendation by an agreed time. Customer communication needs its own authorised owner.

Fictional completed register entry for the packaging example. Assume available stock is 1,200 units and planned consumption is 200 units per working day. The alternate route needs eight working days from an authorised order, and none has yet been placed.

The register should not list “alternate supplier” as an effective existing control while the required evidence remains outstanding. Nor should it wait until stock is exhausted to disclose the gap. Any delay in authorising the alternate could extend the uncovered period beyond two days.

The arithmetic assumes constant demand and usable stock; damaged stock, changing demand or carrier constraints require a revised assessment. The figures are invented and do not prescribe a stock policy. This entry distinguishes a current quantified exposure, an unverified treatment option and a specific next decision, without pretending that a colour rating resolves them.

At each review, ask what changed in the objective, assumptions, control operation or external conditions. Examine a sample of control evidence instead of accepting a repeated green status. Record why the exposure was retained, increased or reduced.

Close improvement actions when their acceptance criteria are met, but retain ongoing monitoring where the underlying risk continues. Review stale entries for relevance and archive them with a reason. Deleting an inconvenient risk without an accountable decision removes useful history.

Do we need expensive software? Start with a controlled record that people can maintain and retrieve. Tool selection should follow the workflow, access needs and scale.

Can we use the same threshold everywhere? Only if it makes sense for the activities and obligations involved. A common reporting structure can coexist with different operational triggers.

What is a useful first step? Select one material risk and trace it through its controls, evidence, action owners and escalation route. Repair the missing connections before expanding the exercise.

AI assisted research and drafting. Sources checked 1 October 2026.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.