Proof of Use: Putting the Board’s Risk Register to the Test
Most UK boards can produce a risk register within minutes of being asked. Fewer can say, without reaching for the document, which entries changed a decision in the past year. That gap matters. A register that exists to satisfy a governance expectation is not the same as one that helps a board govern. The distinction is not academic: it determines whether risk is being managed or merely recorded.
Begin with the decision, not the document
A useful starting point is a single question put to the board: name a decision that was altered because of something in the risk register. Not informed by a general awareness of risk, but changed — a transaction paused, a supplier replaced, a capital commitment reduced, a succession timetable brought forward.
If the room is silent, that is not conclusive proof of failure. Some risks are successfully mitigated and never require a change of course. But prolonged silence usually points to a register that sits outside the decision-making process. It is maintained, refreshed and circulated. It is not used.
The test that follows is deliberately short. It can be completed in an hour with the company secretary, the risk owner and a handful of papers. Its purpose is not to score the register but to establish whether it functions as a decision instrument.
Four questions that expose the register’s condition
For each of the board’s principal risks, ask four questions.
First, who owns it? A named executive, not a function. Second, what would trigger action? A specific event, threshold or change in circumstances — not a general instruction to monitor. Third, when was it last genuinely discussed? Not noted, not received, not included in a pack. Discussed. Fourth, has it reached the agenda before a crisis, or only afterwards?
The answers are often revealing. Ownership is frequently nominal. Triggers are frequently absent. Discussion is frequently conflated with circulation. And the register frequently appears on the agenda only when something has already gone wrong.
Ownership is a person, not a department
A risk owned by “the finance team” is a risk owned by nobody. The test is whether a named director can describe the exposure in their own words, explain its current trajectory and set out what they would need to change it. If the owner cannot do that without reading from the register, the entry is a filing instruction rather than a management responsibility.
This is not a matter of blame. It is a matter of design. Registers that assign ownership to committees or functions allow accountability to diffuse. Registers that name individuals create a point of challenge. The board can ask the owner a question and expect an answer. That is the beginning of useful governance.
Triggers turn a worry into a decision point
Risk appetite statements are often written at a level of abstraction that makes them difficult to apply. A register needs something more operational: a stated trigger. For a key customer concentration risk, the trigger might be a contract renewal date or a change in revenue share. For cyber risk, it might be a failed control test or a sector-wide incident. For succession risk, it might be a resignation or a delayed appointment.
Without triggers, the register is a list of concerns. With them, it becomes a set of decision points. The board knows in advance what would cause it to act, who would bring the matter forward and in what timeframe. That is more valuable than another red-amber-green refresh.
Discussion history is evidence
Minutes are an underused audit tool. Over the past twelve months, count how many times each principal risk received substantive treatment. Look for challenge, alternatives considered and actions agreed. “Noted” is not discussion. Nor is a reference in a lengthy pack that nobody recalls opening.
The presence of dissent is also instructive. A register that records no disagreement across a year is not necessarily a sign of alignment. It may be a sign that risk is being presented as a technical update rather than a contestable judgement. Boards should expect some friction: different views on likelihood, appetite or mitigation. If the register never generates that, it is probably not doing its job.
Agenda placement reveals priority
Risk registers are often discussed in the audit committee, which is appropriate for controls and assurance. But if that is the only place they appear, the board is receiving risk after the decisions that shape it. The stronger test is whether the register informs strategy days, acquisition discussions, capital allocation and succession planning. A risk log that surfaces only in crisis is a post-mortem, not a management tool.
The RAG trap
Red-amber-green reporting is not inherently unhelpful, but it can create the appearance of activity without the substance of thought. Ask what changed since the previous quarter and why. If the movement is cosmetic — a risk moved from amber to red without a corresponding change in facts — the register is being refreshed rather than used. Ask also whether entries have been closed. A register that only grows is a register that is not being curated.
A one-hour audit worth more than a refresh
Select the top ten risks. For each, record the owner, the trigger, the date of last substantive discussion and the decision it has affected, if any. Then discuss the results with the board. The purpose is not to produce a score but to expose whether the register is alive.
A good register does not need more columns. It needs named owners, dated reviews, observable triggers, evidence of challenge and a clear connection to decisions. On that basis, an hour spent testing the register is worth more than another compliance-driven update. The document may be required, but its value lies in use.
