From risk registers to decision systems

Risk / 06 min read

A risk process earns trust when it changes priorities, not when it produces more pages.

A register is a useful starting point, but it is not a management system. A decision system makes the exposure visible to the person who can change it, at the moment a choice is still open.

The first design choice is language. Risks should describe a cause, an event, and a consequence in terms the business can recognise. The second is ownership: every material exposure needs an accountable owner with authority to act.

The third is threshold. Leaders need to know which change requires escalation, which can be managed locally, and which scenario changes the investment case. Finally, the process must close the loop by testing whether the response changed the outcome.

The practical test is simple: after the meeting, does someone know what decision has been made, what evidence supports it, and what signal will tell them to revisit it?