risk-register

Input given to the skill

We're Northwind Logistics, three depots. I need a risk register for the operations committee on 1 October. Here's what came out of the workshop: the WMS vendor (one vendor, no exit plan), not enough drivers for peak, ransomware on the depot laptops (old OS, shared admin login), fuel prices, our ISO 9001 surveillance audit with two open non-conformities, the riverside depot flooding, route planning depending on one analyst (we've fixed that, a second analyst is trained), and customer addresses floating around in spreadsheets. Owners: Priya Shah (Head of Ops) for WMS and flooding, Tom Okafor (Fleet) for drivers and routing, Mei Lin (IT Security) for ransomware, Ana Ruiz (Finance Director) for fuel, Ben Hart (Quality) for ISO, Sam Doyle (Data Protection Lead) for the spreadsheets. 5x5 is fine. [followed by the controls and dates for each risk]

The scope (operations, 12-month horizon), the scale (default 5×5) and every owner, control and date came from the user. The skill wrote each risk as cause, event and consequence, and scored inherent and residual.

The register

northwind-register.csv, eight rows. One row as written:

Script check

Command:

python3 scripts/check_register.py examples/northwind-register.csv --as-of 2026-10-01 --top 5

Real output (exit code 0):

Risk register check
  file:   examples/northwind-register.csv
  as of:  2026-10-01
  scale:  1-5 likelihood x 1-5 impact
  bands:  low 1-4, medium 5-9, high 10-16, critical 20-25
  rows:   8 read, 8 valid, 7 open

Errors (0)
  none

Warnings (2)
  - line 9 [R-008]: treatment is reduce but no controls are listed
  - line 9 [R-008]: treatment is reduce but residual equals inherent (9); the controls change nothing

Overdue (2)
  - line 4 [R-003]: treatment action overdue by 1 day(s) (due_date 2026-09-30), owner IT Security Lead (Mei Lin)
  - line 6 [R-005]: review overdue by 16 day(s) (next_review 2026-09-15), owner Quality Manager (Ben Hart)

Inherent heat map, open risks (rows = likelihood, columns = impact)
  L\I |   1   2   3   4   5
  -------------------------
    5 |   .   .   .   .   .
    4 |   .   .   .   1   1
    3 |   .   .   1   1   1
    2 |   .   .   .   2   .
    1 |   .   .   .   .   .
  low 0, medium 3, high 3, critical 1

Residual heat map, open risks (rows = likelihood, columns = impact)
  L\I |   1   2   3   4   5
  -------------------------
    5 |   .   .   .   .   .
    4 |   .   .   .   .   .
    3 |   .   .   2   1   .
    2 |   .   .   .   2   1
    1 |   .   .   .   1   .
  low 1, medium 4, high 2, critical 0

Top 5 open risks by residual score
  R-002  residual 12 (high), inherent 16  Driver shortage in peak season  [reduce, owner Fleet Manager (Tom Okafor)]
  R-001  residual 10 (high), inherent 15  Single warehouse management system vendor  [reduce, owner Head of Operations (Priya Shah)]
  R-004  residual 9 (medium), inherent 12  Fuel price spike  [transfer, owner Finance Director (Ana Ruiz)]
  R-008  residual 9 (medium), inherent 9  Customer data in shared spreadsheets  [reduce, owner Data Protection Lead (Sam Doyle)]
  R-003  residual 8 (medium), inherent 20  Ransomware on depot laptops  [reduce, owner IT Security Lead (Mei Lin)]

Result: PASS

Summary handed to the committee

Scale: 5×5, likelihood over 12 months, impact on operations objectives. Low 1–4, medium 5–9, high 10–16, critical 20–25.

Residual heat map: as printed by the script above. No critical residual risks; two high.

Decisions needed (3). Deciders are roles the user did not name; confirm them before the meeting.

1. R-002 Driver shortage, residual 12 (high). Approve a third agency contract or accept the penalty exposure on the two retail contracts for peak. Decider: Operations Director.
2. R-001 WMS vendor, residual 10 (high). Approve budget to test the exit plan with a second vendor before year end, or accept single-vendor exposure for another year. Decider: CFO.
3. R-008 Customer data in spreadsheets, residual 9. No controls are listed and the residual equals the inherent score, so nothing is reducing it yet. Agree a control (for example, planning inside the WMS with exports switched off) and a date. Decider: Sam Doyle with the Head of Operations.

Overdue (2):

• R-003 ransomware actions were due 30 September, one day ago. Mei Lin to confirm whether the shared admin account removal is complete.
• R-005 ISO 9001 review was due 15 September. Ben Hart to rescore before the surveillance visit.

Not raised: R-006 flooding is accepted at residual 8 (medium) by its owner, which is within her authority; R-007 is closed and stays in the register as history.

This register prepares material for the operations committee and the risk owners to review. It is not audit or legal advice.