Roll a risk register up into one health score: severity mix, treatment backlog, accepted risks and how much sits above appetite.
A register is judged on flow, not on size: how much of it sits above appetite, whether treatments are moving, and how many risks have quietly been accepted instead of fixed. Accepted risks are penalised deliberately, because acceptance is legitimate once and a habit thereafter, and the reconciliation check exists because unbanded rows are the most common reason a register total does not match its own severity mix. Boards are shown risk counts, but the useful signals are the overdue backlog and the drift of accepted risks — both invisible in a heatmap. This produces a management estimate for steering the process, not an assurance opinion.
Risk Register
Health score = 100 − 0.5 × share above appetite − 0.3 × overdue treatment share − 1.5 per formally accepted risk (max 15) − 2 per point the average risk exceeds appetite (max 20).
Severity mix
Average weighted severity = Σ(count × representative score) ÷ banded risks, on the 25-point 5×5 scale.
Health score = 100 − 0.5 × share above appetite − 0.3 × overdue treatment share − 1.5 per formally accepted risk (max 15) − 2 per point the average risk exceeds appetite (max 20). A register is judged on flow, not on size: how much of it sits above appetite, whether treatments are moving, and how many risks have quietly been accepted instead of fixed. Accepted risks are penalised deliberately, because acceptance is legitimate once and a habit thereafter, and the reconciliation check exists because unbanded rows are the most common reason a register total does not match its own severity mix.
Boards are shown risk counts, but the useful signals are the overdue backlog and the drift of accepted risks — both invisible in a heatmap. This produces a management estimate for steering the process, not an assurance opinion.
This calculator takes 10 inputs: Risks on the register, Critical risks, High risks, Medium risks, Low risks, Treatment actions past their due date, Risks formally accepted above appetite, Average likelihood, Average impact, Appetite threshold on the 25-point scale. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because acceptance moves a risk off the treatment plan without changing the exposure. One or two conscious acceptances with executive sign-off are healthy; a dozen means the register has become a filing system for decisions nobody wants to fund.
There is no target. A register of twenty well-owned risks beats one of four hundred copied from a template, and the tell is whether every entry has an owner, a treatment and a review date. Growth without closures is the pattern to worry about.