Risk register
Business risks found by configured triggers or recorded by hand. Each risk has evidence, an owner, corrective actions and a verified ending. Counts and overdue status are measured on the reporting date, .
Trigger run on the reporting date
| Trigger | Records checked | Matches | Result |
|---|
| Risk | Source record | Severity | Owner | Status | Actions | Review / target | Escalation |
|---|
Statuses follow the workflow Detected → Assessed → Treatment assigned → Under treatment → Resolved → Verified and closed. Accepted, Deferred and Escalated need a reason and a named authority.
Decisions taken instead of treatment
| Risk | Decision | Reason | Proposed by | Authority | Review again |
|---|
| Who | Sees | Can do | Cannot do |
|---|---|---|---|
| Responsible employee | Own actions and the risks they belong to | Update and complete own actions with evidence; propose resolution of own risks | Close, accept or defer a risk |
| Manager | Risks and actions of the own department and team | Assess, assign actions, escalate, verify closure of Low and Medium risks | Verify a High risk; change triggers |
| Management (Owner / CEO) | Every risk; the consolidated view of material risks | Verify High risks; confirm acceptance and deferral | — |
| Authorised administrator | Trigger and escalation configuration | Switch triggers on or off, change thresholds and the escalation ladder | Decide a risk by configuration: decisions stay with the named authority |
Scope in the prototype is shown through the “View as” switch and the “Mine” filter. Hiding is static, not enforced authorization. Exports, search and AI summaries follow the same scope.