In ISO 31000 terms, risk is the effect of uncertainty on objectives. That effect can be negative (a threat) or positive (an opportunity). Enterprise risk management aims to manage these uncertainties through a shared language, shared criteria and a single register, rather than fighting fires one by one. Clause 6.1 of ISO 9001 and management system standards such as ISO 27001 and ISO 45001 also require risks and opportunities to be identified and addressed; a well-built risk register meets these requirements in one place.
You can use the tables in this guide as a template for your own risk register and tick the checklists to track setup with your team.
The ISO 31000 process framework
ISO 31000:2018 defines risk management in three layers: principles, framework and process. The layer most needed on the ground is the process: set scope and criteria, assess risks, treat them, and support the loop with communication, monitoring and recording. The standard is not for certification; it is guidance and can be adapted to an organisation of any size.
- 01Scope and criteria
- 02Identification
- 03Analysis
- 04Evaluation
- 05Treatment
- 06Monitoring and review
- 01
Scope, context and risk criteria
Before assessing risks, write down which objectives, units and processes are in scope. Then define likelihood and impact scales. Every level of the scale must be concrete; “high impact” should mean the same amount, the same downtime or the same reputational outcome for everyone.
| Score | Likelihood | Impact (example: financial / operational) |
|---|---|---|
| 1 | Very low: once in 5 years or less | Negligible: under 0.1% of budget, no downtime |
| 2 | Low: once every 2–5 years | Minor: 0.1–0.5%, a few hours of disruption |
| 3 | Medium: once a year | Moderate: 0.5–2%, one day of downtime or a customer complaint |
| 4 | High: several times a year | Major: 2–5%, a week of disruption, contractual penalties |
| 5 | Very high: monthly or more often | Critical: over 5%, long downtime, legal sanctions or serious reputational damage |
The risk score is usually calculated as likelihood × impact and shown on a heat map. The organisation's risk appetite determines which scores are acceptable and which must be treated. Top management should approve these thresholds.
| Score range | Level | Expected response |
|---|---|---|
| 1–4 | Low | Accepted, reviewed annually |
| 5–9 | Medium | Monitored by the owner, action planned if needed |
| 10–16 | High | Action plan mandatory, reported quarterly |
| 20–25 | Critical | Escalated to top management immediately, urgent action |
Identifying risks
The most common mistake in risk identification is writing a risk as a problem or a missing control. A good risk statement contains a cause, an event and a consequence: “Due to dependence on a single supplier (cause), a delay in supplying a critical raw material (event) may shift the production plan and delay deliveries (consequence).” This structure makes it easier both to pick the right control and to merge similar risks.
- Workshops based on process walks and process maps
- Past incidents, non-conformities, customer complaints and audit findings
- Context analyses such as SWOT and PESTLE
- Results of failure mode and effects analysis (FMEA)
- Regulatory changes, contractual obligations and industry reports
- Information security asset inventories and threat lists
Common mistakes: writing a risk as a missing control such as “lack of training”; using very broad statements (“economic crisis”); each unit recording the same risk under a different name; leaving a unit as the risk owner instead of assigning a person.
Risk register template
A risk register is a single list in which every risk is kept with the same fields. You can start with a spreadsheet; as the number of risks and stakeholders grows, moving to risk management software becomes necessary for versioning, permissions and history.
| Field | Description |
|---|---|
| Risk ID | Unique identifier (e.g. OPS-014) |
| Category | Strategic, operational, financial, compliance, information security, health and safety, environment |
| Risk statement | In cause – event – consequence form |
| Risk owner | The one person accountable for the risk |
| Existing controls | Measures applied today and how effective they are |
| Inherent / residual score | Likelihood × impact before and after controls |
| Treatment strategy | Avoid, reduce, transfer, accept (evaluate for opportunities) |
| Action plan | Action, owner, due date, status |
| Target score | Expected score once actions are complete |
| KRI | A measurable indicator showing the risk is approaching |
| Last review | Date and reviewer |
| Risk ID | Risk statement | Owner | Residual score | Strategy |
|---|---|---|---|---|
| OPS-014 | Dependence on a single supplier may delay a critical raw material and cause late deliveries | Purchasing manager | 4 × 4 = 16 | Reduce: approve a second supplier |
| IS-007 | Unpatched servers may allow a ransomware attack that stops production systems | IT officer | 3 × 5 = 15 | Reduce: patch management, backup testing |
| CMP-003 | Late tracking of regulatory change may cause KVKK non-compliance and administrative fines | Compliance officer | 2 × 4 = 8 | Reduce: regulatory tracking calendar |
Analysis and evaluation
In analysis, first score the inherent risk (as if there were no controls), then score the residual risk taking the effectiveness of existing controls into account. Control effectiveness should rest on evidence, not assumptions: when was the control last tested, has it ever failed? In evaluation, the residual score is compared with risk appetite to decide which risks will be treated.
- 01Set the inherent score
What would likelihood and impact be without controls? This makes the value of controls visible.
- 02List the controls
Separate preventive and detective controls; each control should have an owner and a test frequency.
- 03Calculate the residual score
Lower likelihood and/or impact according to the real effectiveness of controls.
- 04Compare with appetite
A treatment strategy is mandatory for risks above the threshold.
- 05Prioritise
For risks with the same score, velocity (how fast the risk could materialise) and preparedness can be used as a second criterion.
Treatment and action plans
| Strategy | When? | Example |
|---|---|---|
| Avoid | The risk outweighs the benefit of the activity | Deciding not to enter a risky market |
| Reduce | Likelihood or impact can be lowered at reasonable cost | Second supplier, automated backups, training |
| Transfer / share | The impact can be passed to a third party | Insurance, contract clauses, outsourcing |
| Accept | Residual risk is within appetite or treatment is too costly | Record and monitor |
Every action needs a single owner, a realistic due date and evidence that it is complete. When an action is done, the residual score is re-rated; if the score does not drop, the action's effectiveness is questioned. When a risk materialises into an incident, the corrective action (CAPA) process takes over and the lessons learned are fed back into the risk register.
Monitoring, KRIs and reporting
A risk register that is updated once a year loses its value. Key risk indicators (KRIs) are measurable data that show a risk is approaching: the share of raw material from a single supplier, days of delay on critical patches, the number of open audit findings. Set a threshold for each KRI and have an automatic alert sent to the risk owner when it is crossed.
| Meeting / report | Frequency | Participants and content |
|---|---|---|
| Risk owner review | Monthly | KRIs, action status, new risks |
| Risk committee | Quarterly | High and critical risks, heat map, overdue actions |
| Management review | Annually | Risk appetite, criteria, effectiveness of the framework |
| Immediate notification | When it happens | Critical threshold crossed or risk materialised |
Conclusion
Effective risk management is not a large document but shared criteria, clear ownership and a regular review cadence. Define concrete scales, write risks as cause–event–consequence, assess control effectiveness with evidence, and feed the register with incidents and KRIs. OREL RMS manages the risk register, actions and KRI alerts in one place, and OREL QMS links non-conformity and CAPA records to risks, making this loop work on the ground.