A business risk assessment template records what could affect an objective, how serious the exposure is, the controls in place and who will follow up. The worked example below shows the fields in a RiskMate risk register entry, using an exchange-rate risk to illustrate the structure.
Use the field guide to plan your own register. The screenshot illustrates the software entry; the examples and dates are historical, and the ratings must be adapted to your organisation’s assessment criteria.
Example risk assessment record
Field guide: what to record and why
Assessment Date
12/08/2016 – This is the date that you actually did the risk assessment.
Title
Exchange Rate – The title of the assessment.
Corporate Objective
To maintain financial viability – Which corporate objective does this assessment
fall under?
Principal Inherent Risk Description
Impact on foreign transactions – Describe the risk.
Category
Finance – Group your risk assessments into categories for easier management.
Department
Finance – Group your risks into departments for easier management.
Business Unit
Accounting – Group your departments into business units for greater reporting.
Inherent Impact
Critical – The impact this would have on the business.
Inherent Likelihood
Almost Certain – How likely this is to happen.
Inherent Risk Value
£0 – The historical record shows this value. In your assessment, record a
supported estimate where appropriate; zero should not stand for an unknown
financial exposure.
Inherent Rating
Extreme – The rating taken from the risk matrix.
Policies, Procedures & Controls
You can assign company policies, procedures or controls to the risk.
Key Controls In Place
Treasury management review & financial advisers – The controls you currently
have in place.
Residual Impact
Critical – The impact this would have on the business after the controls are in
place.
Residual Likelihood
Almost Certain – How likely this is to happen with the current controls in
place.
Residual Risk Value
£0 – The value entered in this example after controls. Assess the remaining
financial exposure using available evidence, and explain uncertainty.
Residual Rating
Extreme – The rating taken from the risk matrix.
Formal Review Frequency
Annual – How often the risk assessment should be reviewed.
Formal Review Date
12/08/2017 – The next review date.
Risk Owner
A named risk owner – The person accountable for reviewing the risk and
coordinating its response.
Principal Assurances
Any assurances you want to assign to the assessment (up to 3).
Gaps, Action, Responsibility & Time-scale
Any gaps or actions etc that you need to mention.
Independent Assurance
Internal audit – Any independent assurance.
How to use the template
- Link the risk to an objective and describe its cause, possible event and consequence.
- Assess the exposure before controls using your agreed likelihood and impact definitions.
- Record the controls that actually operate, then assess the remaining risk. Explain why a rating stays the same if the controls have not reduced it.
- Assign further actions to named people with due dates, and choose a review date suited to the risk.
- Revisit the entry when circumstances change and check whether the actions have helped.
For help choosing an assessment approach, read our guide to six risk assessment methods. For workplace health and safety assessments, use HSE’s template and examples to cover the relevant hazards, people and controls.
Keep the register current
An online risk register gives owners a shared place to maintain these records. Explore RiskMate’s features or request a demo to see the assessment fields and reporting in use.