A GRC risk-register worked example with a useful revision history

A useful risk-register entry lets another person understand the scenario, why it matters, what supports the assessment and who must do what next. The record should also show when new evidence changed the assessment. A short title and a red status cell rarely explain enough on their own.

The example below is original fictional practice. Its fields are a teaching structure, not a mandated format or a substitute for an organization's risk methodology.

The case: recovery depends on an unverified process

Fictional Marlow Planning uses a scheduling application for client assignments. The application owner says a backup runs each night. The supplied records show five recent job-completion messages, but no restore exercise or record establishing what the backup includes. The business sponsor says an extended scheduling interruption would delay allocation of staff to client work.

The scenario is not simply “no restore test.” That is an evidence or control concern. Describe the possible event and its business consequence: if the application becomes unavailable, recovery may take longer than the business can tolerate because the recoverability of the retained data has not been established by the supplied package.

That wording does not claim the backups are unusable. It preserves the difference between a known failure and uncertainty requiring investigation.

A completed first record

Field	Fictional entry MR-004, revision 1
Scope	Scheduling application supporting client staff allocation
Scenario	An application interruption could delay staff allocation if recovery cannot restore the required scheduling data in time
Evidence	BK-01: five backup-job completion messages; BN-01: sponsor's description of scheduling dependency
Known limitation	No restore result or backup-scope record supplied; required recovery time and acceptable data loss not yet agreed in this exercise
Assessment	Material uncertainty about recovery capability; formal rating pending the applicable criteria and missing facts
Proposed response	Confirm recovery requirements, document backup scope and arrange an authorized restore exercise in an appropriate environment
Action owner	Application owner, with the business sponsor defining operational needs
Decision owner	The person authorized under Marlow's risk process; confirm their identity before requesting acceptance
Review trigger	Receipt of scope evidence and restore results, or a material change in scheduling dependency
Status	Assessment open; no risk acceptance recorded

The action owner and decision owner may be different people. A person who arranges an exercise is not automatically authorized to accept the remaining risk.

Explain a rating only when its basis exists

If your organization's method requires a rating at this stage, apply its criteria and record the uncertainty. Do not invent a numerical likelihood from five successful job messages. Job completion does not by itself establish that the data needed for recovery was captured and can be restored.

Ask what the rating is meant to help decide. If the immediate decision is whether to investigate recovery capability, a clearly described uncertainty and next action may be more informative than unexplained arithmetic. Follow the actual method in real work, including its treatment of incomplete evidence.

The interview version of this issue is covered in the risk-assessment example. This article focuses on maintaining the written record after that discussion.

Revise the record when evidence arrives

In the second stage, the owner supplies backup-scope documentation and a supervised exercise record showing that scheduling entries were restored in a separate environment. The record says that integration configuration was excluded. The sponsor has still not agreed a recovery-time requirement.

Revision 2 should acknowledge the new support: restoration of the covered scheduling entries was demonstrated under the recorded conditions. It should retain the excluded integration configuration and the missing business requirement as limitations. “Restore completed” is too broad if readers might infer recovery of the whole service.

Use a short revision note:

Revision 2: Added BK-02 scope record and RT-01 exercise result. Updated the observation to reflect restoration of the covered scheduling entries. Integration configuration remains outside the demonstrated scope. End-to-end service recovery time has not been established against an agreed business requirement. Assessment remains open.

Keep the original evidence references. Do not silently overwrite the first conclusion so that the record appears to have known the later facts all along.

Use status words precisely

“Action completed,” “assessment updated” and “risk accepted” describe different events. The restore exercise may be complete while the assessment remains open. Acceptance requires a decision by the authorized person under the relevant process; it is not implied by a green action-tracker cell.

Similarly, a planned control is a proposal until there is evidence that it has been implemented and behaves as assumed. Keep a proposed future state separate from observations about current capability.

Your reusable record structure

Copy these prompts into a document: scope; event and consequence; evidence references; assumptions and limitations; assessment rationale; response options; action owner; decision owner; review trigger; status; revision note.

Use synthetic material for a portfolio and label the whole record as an independent fictional exercise. You can keep the evidence references in the free register and summarize the next decision in a one-page memo.

For a larger coherent fictional case with editable companions, inspect the Risk & Evidence Portfolio Kit and its genuine preview. More free examples are in the field notes.

Compare the risk-register project path for a free starting exercise, exact book fit and sample boundaries.