GRC & Audit Support · Lesson 3 of 8
Scoring and tracking risk
A risk register helps a team compare concerns and track decisions. Scores are a model for discussion, not precise predictions.
A treatment plan is not a completed fix
Fictional shared-administrator-account risk.
- OpenAssess using the agreed scale
Record assumptions, impact, and likelihood.
- PlannedAssign named-account rollout
Name the owner and target date.
- ImplementedCollect change evidence
A reported change still needs validation.
- VerifiedUpdate the risk decision
Record remaining risk and the authorized disposition.
Read the visualShould the item be marked resolved when a plan is approved?
No. Track implementation and verification, then record the appropriate risk decision.
Use a consistent scale
Define what low, medium, and high mean for likelihood and impact in the organization.
Identify the owner
Assign responsibility for the risk and track the chosen treatment, due date, and status.
Revisit after treatment
Record remaining risk after safeguards are applied. Verify treatment rather than reducing the score because a task was assigned.
Put it in context
A shared administrator account receives a high impact rating under Harbor Books’ scale. An owner plans named accounts and a review date. The risk remains open until the change is verified.
A risk score needs a rationale, an owner, and a review date.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.