The problem
Most risk registers start from a blank page, get filled once a year and are rarely reviewed. The work the board has already done, its audits and its data, almost never reaches the register.
What I built
A live register. Each risk has a title, what it threatens, a category, likelihood and impact scores, an owner, a handling choice (tolerate, treat, transfer or stop), the controls in place, the planned actions, a review date and a residual score, so the board can watch a risk come down as the controls take hold. Principal risks rise to the top and into the board pack.
The register does not start empty. A weak audit suggests a risk, pre-filled with a category, a starting score and the actions from that audit's own plan. When attendance, staffing, finance or pupil numbers move outside a healthy range, those signals arrive as suggested risks too, so a worrying trend reaches the register before it becomes a crisis.
Design decisions
A suggestion is never a risk until the board says so. It arrives as a draft the board accepts by naming an owner, or dismisses. A strong audit suggests nothing, so the list stays signal rather than noise, and running the same audit again does not pile up duplicates.
What you can see
For a school, its own register. For an academy trust, every school's open risks in one heatmap by category, with a list of principal risks across the trust.
(opens the full-size screenshot in a new tab)The result
Risk management a board can show: each risk named, scored, owned and reviewed, and fed by the governance work the board already does.