Risk Register Report

The Risk Register report is your single view of privacy risk posture across all three registers — risks raised on assessments, risks raised on incidents, and standalone risks that stand on their own. It answers whether exposure is under control right now, not just what happened inside a date range.

What This Report Shows

• Open risks, and how many sit over appetite — exposure beyond what the organization has decided it will tolerate.
• Residual high/critical risks — what remains after treatment, the figure that matters most for ongoing exposure.
• Overdue treatment targets and stale reviews — risks whose action plan or periodic review has fallen behind.
• Expired acceptances — risk acceptances whose sign-off no longer covers today.
• Red key risk indicators — KRIs currently showing a red RAG status.
• Risks realized as incidents — cases where a risk you tracked actually materialized.
• An inherent-vs-residual view comparing risk before and after treatment, so you can see whether treatment is actually moving exposure down rather than just being recorded as done.

Reading the As-Of Banner

This report describes a current position, not activity inside a date range. The panel carries a banner stating the as-of date, and the period selector at the top of the Reports panel does not narrow these headline figures — a risk that went over appetite two years ago is exposure today, and date-filtering it would hide exactly the stale entries the report exists to surface. Where a period-scoped figure does make sense (risks raised or closed in the period), it is labelled as such, so the date control is never inert.

A Risk Convention Worth Knowing

An accepted risk counts as open. Acceptance is a live posture with a sign-off and an expiry date, not a disposal — so it still shows as open exposure. That is also why acceptances expired is its own finding: the sign-off no longer covers the position. Overdue treatment targets exclude accepted risks, because acceptance replaces treatment rather than sitting alongside it.

Related Pages

• Risk Details — the panel behind each risk: status, inherent and residual scoring, and the risk-management card with governed acceptance and closure.
• Risk Indicators — key risk indicators, RAG status, and recording readings.
• Reports — the reports menu this report opens from.