Risk Register

​

Conceptual Model

The Risk Register module organises school-level and trust-wide risk governance through a clear hierarchical architecture linking Risk Areas, individual Risk Items, strategic Response Frameworks, and Residual Risk Scoring:

​

1. Risk Hierarchy & Unique Key Identification

• Risk Areas: High-level operational domains (such as General, Governance & Strategy, Financial Sustainability, Premises & Estate, Safeguarding & Pupil Welfare, or IT & Cyber Security). Each area is assigned an area owner and provides a logical container for related risks.
• Risk Items: Individual identified risks or vulnerabilities within an area. Every risk item is assigned an automated, permanent key code combining the school’s configured key prefix and a sequential number (e.g., SCH001, SCH002). This guarantees unambiguous referencing across multi-school trusts and board papers.
• Central Template Syncing: In Multi-Academy Trusts (MATs) or federations, key risk areas and baseline risks can be defined centrally and synchronised across all member academies with daily automated updates. Centrally synced items display a lock badge to ensure trust-wide policy compliance.

---

​

Risk Evaluation & Scoring Matrix

The module employs an objective 5×5 Likelihood and Impact assessment engine to evaluate risk severity both before control measures are applied (inherent risk) and after treatment (residual risk).

​

Likelihood Scale (1 to 5)

Evaluates the probability of the risk occurring:

• Rare (1, Blue): Unlikely to occur; highly exceptional circumstance.
• Unlikely (2, Green): Could occur at some point, but probability remains low under normal operating conditions.
• Likely (3, Yellow): Fairly expected to occur or has occurred occasionally in recent school terms.
• Highly likely (4, Orange): High probability; expected to occur multiple times or within the current academic year.
• Extremely likely (5, Red): Almost certain to occur without immediate intervention.

​

Impact Scale (1 to 5)

Evaluates the severity of consequences across financial, educational, reputational, or safety dimensions:

• Slight impact (1, Blue): Minor operational inconvenience; negligible financial or educational consequence.
• Moderate impact (2, Green): Localised disruption managed through normal day-to-day contingency measures.
• Significant impact (3, Yellow): Measurable disruption to teaching, adverse local publicity, or moderate budget variance.
• Severe impact (4, Orange): Serious disruption, potential regulatory sanction, major budget impact, or critical safety incident.
• Extreme impact (5, Red): Catastrophic impact, prolonged school closure, major statutory breach, or existential threat.

​

Calculated Composite Risk Level (0 to 10)

The overall risk level is automatically calculated as the sum of Likelihood and Impact (Likelihood + Impact = Risk Level):

---

​

The 4Ts Strategic Response Framework

The module embeds the widely recognised 4Ts Risk Response Framework (established in public sector governance and HM Treasury guidance) to categorise how school leaders address each risk:

• Treat (Default): The standard approach for the vast majority of school risks. Leaders implement specific internal control measures (e.g., enhanced staff training, dual-authorisation finance limits, visitor badge systems) to reduce likelihood or severity.
• Tolerate: Used when a risk cannot be further mitigated at reasonable cost, or where the residual risk is deemed acceptable within the school’s risk appetite (e.g., minor fluctuations in utility costs).
• Transfer: Used when the risk can be effectively shared or offloaded to a third party (e.g., comprehensive RPA/commercial insurance cover, contracting external specialist contractors for high-voltage maintenance).
• Terminate: Used when the risk is unacceptably high and cannot be treated or transferred cost-effectively, requiring the school to cancel or fundamentally alter the activity (e.g., canceling a high-risk excursion or decommissioning obsolete equipment).

---

​

Management Scopes (Multi-Tier & MAT)

To reflect multi-academy trust and federation governance models, each risk item can be classified by its management tier:

• School: Managed locally by school-level staff, business managers, or heads of department.
• Central: Managed centrally by trust executive teams, central finance leads, or the local authority.
• School & central (Both): Shared accountability between central trust leaders and local academy staff.
• Unmanaged: Newly identified or orphaned items requiring management level assignment.

---

​

Roles & Permissions Matrix

The module provides role-based access control to ensure appropriate segregation of duties, delegation of risk mitigations, and read-only transparency for governance boards and auditors:

---

​

Operational Screen Tour

​

1. Main Risk Register (/risk/register)

The primary operational hub for staff, managers, and governors:

• Progress & Category Grouping: View all active risk items ordered by risk area.
• Live Search & Filter: Rapidly search risks by description or keyword.
• Visual Status Indicators: Left-border colour badges and colour-coded triple-circle indicators (Likelihood, Impact, Level) display pre- and post-treatment risk at a glance.
• Row Actions & Dropdown: Open detailed view, edit in modal, inspect revision history, or archive items.
• Bulk Action Bar: Select multiple items to reassign owners, change risk areas, or archive.
• A3 Landscape PDF Export: Generate a publication-ready A3 PDF register formatted for governing body and trust board review.

​

2. Risk Item Detail (/risk/item/{item})

An interactive management card providing complete detail for an individual risk:

• Key Code & Identification: Displays the unique school identifier (e.g. SCH001) and lock indicator if centrally managed.
• In-Place Modal Editing: Click to update Description, Controls, and Commentary with instant saving and activity logging.
• Dual Matrix Controls: Select Likelihood and Impact from colour-coded dropdowns before and after control measures, with instant recalculation of composite Risk Levels.
• 4Ts Response & Management Scope: Select the strategic response (Treat, Tolerate, Transfer, Terminate) and management tier (School, Central, School & central).
• Owner Assignment: Reassign the risk to any active staff member holding the Risk Register Owner role.

​

3. Item Revision History (/risk/item/{item}/history)

A complete, immutable audit trail for governance transparency:

• Lists every historical update in reverse chronological order.
• Details the date of modification, the staff member who made the update, and the exact changes applied (e.g. description updates, score changes, revised control text, or ownership transfers).

​

4. Area & Key Administration (/risk/admin/areas)

Accessible to Risk Register Managers and Administrators:

• Area Management: Create custom risk categories, edit names, and delete unused categories (safeguarded against deleting areas containing active items).
• Drag-and-Drop Reordering: Rearrange risk areas to match school committee structures.
• School Key Prefix Configuration: Set the short prefix used to generate unique item codes (e.g., SCH, PRI, ACAD).
• Active vs Archived Views: Toggle between active areas and archived records.

​

5. Role Management (/risk/admin/owners, /risk/admin/viewers)

Dedicated management views to delegate risk responsibilities across school staff and governance boards without navigating away from the module.

---

​

Automated Notification Schedule

The Risk Register module maintains institutional accountability through automated background notifications:

---

​

Multi-Academy Trust (MAT) & Central Coordination

For Multi-Academy Trusts, federations, and diocesan groups:

• Centrally Defined Risk Areas & Items: Trust executive teams can create standardised risk templates in the central trust tenant.
• Automated Trust-Wide Synchronisation: The sync:risk console command propagates central areas and items to all academy schools, applying matching IDs and locking structural fields against local alteration.
• Local Ownership & Contextual Controls: Academies retain full flexibility to assign local risk owners, evaluate school-specific likelihood and impact, tailor operational control measures, and add local governance commentary.