Risk register
Score risks on likelihood × impact, track the treatment, and watch the residual position move as mitigations land.
Heat map — residual position
6 live risksImpact
R-04
R-02
R-01
R-03
R-05
R-06
Likelihood →
Register
| Code | Risk | Category | Owner | Inherent | Residual | Review | Status | |
|---|---|---|---|---|---|---|---|---|
| R-01 | Supplier concentration — single source for networking stock Qualify a second supplier for the top three SKUs by spend | Supplier | Marcus Hale | 16 | 8 Moderate | Oct 1, 2026 | Mitigating | |
| R-02 | Unsegregated purchase approval under threshold Lower the auto-approval threshold and add a second approver Linked to 404(b) — regulations | Financial | Priya Raman | 15 | 15 High | Sep 30, 2026 | Open | |
| R-03 | Stale access rights after role changes Quarterly access review tied to the HR employee record Linked to A.9 — regulations | Cyber | Daniel Okafor | 16 | 16 Critical | Sep 15, 2026 | Open | |
| R-04 | Personal data retained beyond the stated period Automated retention purge on the customer record Linked to Art. 30, Art. 33 — regulations | Regulatory | Daniel Okafor | 10 | 5 Moderate | Nov 1, 2026 | Mitigating | |
| R-05 | Warehouse injury from unmaintained equipment Preventive maintenance schedule in the Assets module Linked to 1910.157 — regulations | Operational | Marcus Hale | 9 | 9 Moderate | Sep 12, 2026 | Open | |
| R-06 | Key-person dependency in payroll processing Cross-train a second payroll administrator | People | Alicia Ferrer | 9 | 4 Low | Dec 1, 2026 | Mitigating |
“Mitigate” drops residual likelihood by one band and moves the risk on the heat map — impact stays where it is, because a treatment rarely changes how bad the event would be.