Ask a risk manager what could be wrong with their register and you will hear about ratings. Too optimistic, too pessimistic, inconsistently scored between departments. Fair concerns — but in practice, that is rarely what breaks first.
What breaks first is the register failing to hold together. A risk marked In progress that carries no treatment at all. A strategy of Accept sitting above three open actions. A residual rating well below the inherent one, with no sentence anywhere explaining what earned the drop. None of these is a wrong number.
Two kinds of defect hide in that description, and it is worth separating them: conflicts, where two entries cannot both be true, and gaps, where an entry claims something the record never supports. A conflict is the more embarrassing of the two. A gap is the more common.
Both matter for the same reason: they are the defects an outsider can find without knowing your business. An auditor cannot tell whether "likelihood 3" is right for your supplier concentration. They can absolutely tell that you closed a risk while its actions are still running — and once they find one, they start looking for others.
Why they accumulate
Not through carelessness. Through the order in which people actually work.
Nobody fills in a risk the way the model describes it. Somebody opens an entry after a workshop and types the title and the context while it is fresh. The rating waits for the person who knows the numbers. The treatment waits for the meeting where it is decided. The residual assessment waits for the treatment. Each pause is reasonable; each leaves the entry in a state that is briefly inconsistent and permanently invisible.
Then the register grows. At forty entries nobody re-reads the ones they did not write, so the half-finished states stay. By the time the register matters — the audit, the board pack, the certification — nobody knows which entries are mid-flight and which are simply wrong.
The cure is not discipline. It is a check you can repeat, cheaply, over the whole register instead of one entry at a time.
The five groups
Seventeen checks, sorted by what they tell you. You can run them in a spreadsheet with filters, and any tool worth its subscription should run them for you.
1. The status promises more than the assessment delivers
The status field is the register's summary of itself, which makes it the first thing to read and the easiest to overstate.
- No assessment at all, yet the status has moved past Open. The entry claims work is under way on a risk nobody has sized.
- Half an inherent assessment — likelihood without impact, or impact without likelihood. A score needs both; one value alone produces no severity and no position on the 5×5 matrix.
- In progress with neither a strategy nor an action. In progress says the risk is being treated right now. Nothing on the entry says who is doing what, by when.
- Monitored without a strategy. Monitored is a decision to watch rather than act — but the decision itself is missing, so nobody can tell watching apart from forgetting.
- Half a residual assessment. The same gap on the other rating, and it hides better: the entry looks treated until somebody asks for the score.
2. The treatment contradicts the decision
Four of the five treatment strategies make a promise about what happens next. These checks find the entries where the promise and the work disagree.
- Accept with open actions. Accepting a risk means carrying it deliberately. If people are still working on it, the register is describing two different decisions — and the actions usually turn out to predate the decision.
- Accept with a residual rating below the inherent one. This one depends on what your register means by Accept. Where it means "no further treatment is planned" — the reading most tools use, EasyRisk.io included — the two ratings should match, and a lower residual needs either a named control already in place or a different strategy. Where your convention is that Accept applies to the risk as it stands after existing controls, record those controls in the justification so the gap is not left to the reader.
- A strategy with no action under it. Mitigate, Avoid and Transfer are all promises of activity. Without a single action carrying an owner and a date, the promise is a word.
- Actions with no strategy chosen. The reverse case: work is happening, and the register never recorded what it is meant to achieve.
- Mitigate with no effect on the rating. The strategy says the exposure was reduced; the residual rating equals the inherent one. Either the treatment has not landed yet, or it did not work — both worth knowing, neither worth hiding.
3. The residual rating is not earned
This group produces the most uncomfortable audit conversations, because residual risk is where optimism collects.
- Residual above inherent. Treatment made it worse, which happens, but almost never on purpose — usually it is a data-entry slip that nobody re-read.
- A residual rating with no inherent one. The register states what is left after treatment without ever stating what there was to begin with. The delta everyone quotes cannot be computed.
- A strategy with no residual rating. A decision was made and its effect was never assessed, so the register cannot say whether the treatment was worth its cost.
- A large drop with nothing written to explain it. Extreme down to low is a claim about controls. If no sentence names them, the claim rests on nobody's memory in particular. This is the single check that most often turns into a finding — and the easiest to fix while the reasoning is still fresh.
4. Nobody is accountable
- No owner. One field, and the most consequential one to leave empty. A risk without an owner has no one to chase the actions, no one to answer at the review, and no one the register can name when leadership asks who is on it. In practice unowned risks are also the ones that stop being updated first, which makes this check a leading indicator for the rest.
5. The cycle has stopped
Risk management is a loop, and a register records whether the loop is turning.
- Monitored, review overdue, and no review ever recorded. The entry claims a watching brief that has never produced a single observation. See monitoring and review for what a working cadence looks like.
- Closed with actions still running. Closing says the matter is settled. Open actions say otherwise, and they will keep appearing in reports where nobody expects them.
Running the check
Three practical notes, learned the tedious way.
Check the saved state, not the entry you are editing. Half of these findings appear and disappear while somebody types. The check belongs to review time, not to data entry.
Do not let the check block writing. A register that refuses half-finished input is a register people stop using — they keep the real work in a side document and paste it in later, which is worse than any inconsistency. Let the entry be saved; let the contradiction be visible.
Judge a closed risk by one rule only. Once a risk is closed it is out of active management, and holding it to the full list produces a page of findings nobody will act on. Running actions under a closed risk are the exception — those matter, because they are still consuming someone's time.
What this is not
It is not a quality score. A register with fourteen findings across two hundred entries is in decent shape; the same fourteen across twenty entries is not, and no single number captures that. The list is a work queue, not a grade.
It is also not a substitute for the judgment questions — whether your scales mean the same thing to every department, whether the top ten are actually your top ten, whether anything is missing entirely. No automated check finds a risk that was never written down. What it does is clear the mechanical defects out of the way, so review time goes to the questions that need a human.
Doing it continuously instead of annually
Every check above is mechanical: two fields, one comparison. That is exactly the kind of work worth handing to the tool that already holds the data.
In EasyRisk.io these seventeen rules run against the saved state of every risk — on the risk itself, where each finding names the contradiction and links to the field that settles it, and across the whole register, so the person accountable for it sees the queue without opening two hundred entries. Nothing blocks a save. The rules only make visible what was already true.
Frequently asked questions
How often should you run a register health check? Before anything that puts the register in front of someone else — an audit, a board pack, a certification visit — and once a quarter regardless. If the check is automated, the answer is continuously, and the quarterly pass becomes a formality rather than an evening.
What makes a risk register audit-ready? Not perfection. An auditor is looking for evidence that the register is maintained: ratings with reasoning, treatments with owners and dates, reviews that happened when they were due, and a history showing who changed what. Conflicts and gaps undermine all four at once, which is why they are worth clearing first.
Are these checks the same as a risk assessment? No. A risk assessment judges the risks. A health check judges the record of the risks. A register can be internally perfect and still miss the risk that puts you out of business — see risk identification techniques for the other half of the job.
Can you run these checks in Excel? Most of them, with filters and a few helper columns — status against rating, strategy against action count, residual against inherent. What a spreadsheet cannot do is run them continuously and show you the result without someone rebuilding the filters, which is one of the structural limits of the format.
A register that does not hold together is not a badly managed register. It is usually a well-used one that nobody has read end to end in a year. Reading it end to end is the whole exercise — the seventeen checks just tell you where to look.