Building a Risk Register

A table of threats ranked by exposure

Business Risk AnalysisThe Risk Register & HeatmapFree preview

⏱️ About 16 min

Northwind Trading's risk register lists three threats: a 20% chance of a $500,000 supplier disruption, a 15% chance of an $800,000 data breach, and a 30% chance of a $150,000 key-staff loss. Scored by exposure, the data breach tops the list at $120,000 -- and the register's total weighted threat is $265,000.

💡

The big idea: A risk register lists each threat with its probability and impact; each row carries an exposure of probability ($P$) times impact ($I$), and you rank the register by that exposure.

🎯 By the end, you'll be able to

Define a risk register and the columns it carries.
Compute each row exposure as probability times impact.
Rank the register by exposure and total the rows.

📎 Helpful to know first

Completion of Module 1: What Is Business Risk?

A home for every threat

A risk register is a table with one row per threat. Each row records the risk, its probability ($P$, as a decimal: 20% becomes 0.20), its impact ($I$, the dollar loss if it happens), and its exposure -- probability times impact. List every threat, compute each exposure, and you can rank the whole register from heaviest weighted threat to lightest and total it.

\[ Exposure = P \times Impact \quad;\quad Total = \sum_i (P_i \times Impact_i) \]

Reading the formula

Northwind scores three rows: R1 a supplier disruption at 20% x $500,000 = 0.20 x 500,000 = $100,000; R2 a data breach at 15% x $800,000 = 0.15 x 800,000 = $120,000; R3 a key-staff departure at 30% x $150,000 = 0.30 x 150,000 = $45,000. The total is 100,000 + 120,000 + 45,000 = $265,000, and the highest-exposure row is R2 at $120,000 -- not R3, even though R3 is the most likely, because exposure weights likelihood by how much each threat would cost.

🔑 Rank by exposure, not by likelihood

A very likely small loss can sit below a rare large one once you multiply. Sorting the register by exposure -- and reporting the total -- tells you where the weighted threat is concentrated and how much the company is carrying overall.

🎮 Risk-Register Builder LIVE

Predict first: Predict first: with R1 20% x $500,000, R2 15% x $800,000, and R3 30% x $150,000, what is each exposure, the total, and the top row?

Slide the probability and impact of each risk to watch its exposure bar; the highest exposure is highlighted and the running total updates.

📝 Worked example: Northwind Trading builds a register with three rows: a 20% chance of a $500,000 supplier disruption (R1), a 15% chance of an $800,000 data breach (R2), and a 30% chance of a $150,000 key-staff departure (R3). Find each exposure, the total, and the highest-exposure row.

1. R1 exposure = probability x impact = 0.20 x 500,000 = $100,000.
2. R2 exposure = 0.15 x 800,000 = $120,000.
3. R3 exposure = 0.30 x 150,000 = $45,000.
4. Total = 100,000 + 120,000 + 45,000 = $265,000.
5. Highest-exposure row = R2 ($120,000).

✓ R1 $100,000; R2 $120,000; R3 $45,000; total $265,000; highest R2

✏️ Practice: A register row lists a 25% chance of a $240,000 loss. What exposure goes in the register?

💡 Hint

Exposure is probability (as a decimal) multiplied by impact.

Solution

1. Exposure = 0.25 x 240,000 = $60,000.

Check your understanding

1. A register row lists a 20% chance of a $500,000 loss. What exposure goes in that row?

0.20 x 500,000 = 100,000.

2. With R1 exposure $100,000, R2 $120,000, and R3 $45,000, which row has the highest exposure?

R2 at $120,000 is the largest of the three, so it ranks first even though R3 is the most likely.

✅ Key takeaways

A risk register lists each threat with its probability and impact.
Each row exposure is P x Impact; the total is the sum of all rows.
Rank the register by exposure so the heaviest weighted threat comes first.

➡️ A register multiplies probability by impact. Next we replace raw probabilities and dollar impacts with a simple 1-to-5 scoring scale so every risk speaks the same language.

Ready for the next step? Back to the course outline →