> ## Documentation Index > Fetch the complete documentation index at: https://docs.cleverschool.systems/llms.txt > Use this file to discover all available pages before exploring further. # Risk Register > Conceptual Model, Roles & Operations > [card] [Getting Started](./getting-started) > [card] [Tutorials](./tutorials) > [card] [Workflows](./workflows) ## Conceptual Model The Risk Register module organises school-level and trust-wide risk governance through a clear hierarchical architecture linking **Risk Areas**, individual **Risk Items**, strategic **Response Frameworks**, and **Residual Risk Scoring**: ```mermaid theme={null} flowchart TD Register["School Risk Register (Master Register)
• Search & filters • Colour-coded risk indicators
• School key prefix (e.g. SCH001) • A3 Landscape PDF Export"] Area["Risk Area (e.g. Finance, Governance, Health & Safety, IT)
• Assigned Area Owner • Drag-and-drop presentation order
• MAT central template synchronisation • Deletion safeguards"] Item["Risk Item (Specific Identified Threat or Vulnerability)
• Unique incremented key code • Assigned Item Owner
• Management Scope: School / Central / Both / Unmanaged
• Strategic Response: Treat / Tolerate / Transfer / Terminate"] Scoring["Dual Matrix Scoring Engine (Pre- & Post-Treatment)
• Likelihood (1–5) + Impact (1–5) = Risk Level (2–10)
• Evaluated before controls & re-evaluated after controls"] Controls["Mitigation Controls & Governance Commentary
• Practical control measures • Explanatory notes for governors
• Immutable time-stamped revision history"] Register --> Area Area --> Item Item --> Scoring Item --> Controls ``` ### 1. Risk Hierarchy & Unique Key Identification * **Risk Areas**: High-level operational domains (such as *General*, *Governance & Strategy*, *Financial Sustainability*, *Premises & Estate*, *Safeguarding & Pupil Welfare*, or *IT & Cyber Security*). Each area is assigned an area owner and provides a logical container for related risks. * **Risk Items**: Individual identified risks or vulnerabilities within an area. Every risk item is assigned an automated, permanent key code combining the school's configured key prefix and a sequential number (e.g., `SCH001`, `SCH002`). This guarantees unambiguous referencing across multi-school trusts and board papers. * **Central Template Syncing**: In Multi-Academy Trusts (MATs) or federations, key risk areas and baseline risks can be defined centrally and synchronised across all member academies with daily automated updates. Centrally synced items display a lock badge to ensure trust-wide policy compliance. *** ## Risk Evaluation & Scoring Matrix The module employs an objective 5×5 Likelihood and Impact assessment engine to evaluate risk severity both **before** control measures are applied (inherent risk) and **after** treatment (residual risk). ```mermaid theme={null} flowchart LR subgraph PreTreatment["1. Inherent Risk (Before Controls)"] LBefore["Likelihood Before
(Scale 1 to 5)"] IBefore["Impact Before
(Scale 1 to 5)"] LBefore & IBefore --> LevelBefore["Risk Level Before
(Composite 2 to 10)"] end subgraph Treatment["2. Applied Mitigation"] Response["4Ts Response Strategy
Treat / Tolerate / Transfer / Terminate"] ControlsInput["Control Measures
Specific operational safeguards"] Response & ControlsInput end subgraph PostTreatment["3. Residual Risk (After Controls)"] LAfter["Likelihood After
(Scale 1 to 5)"] IAfter["Impact After
(Scale 1 to 5)"] LAfter & IAfter --> LevelAfter["Risk Level After
(Composite 2 to 10)"] end PreTreatment --> Treatment Treatment --> PostTreatment ``` ### Likelihood Scale (1 to 5) Evaluates the probability of the risk occurring: * **Rare (1, Blue)**: Unlikely to occur; highly exceptional circumstance. * **Unlikely (2, Green)**: Could occur at some point, but probability remains low under normal operating conditions. * **Likely (3, Yellow)**: Fairly expected to occur or has occurred occasionally in recent school terms. * **Highly likely (4, Orange)**: High probability; expected to occur multiple times or within the current academic year. * **Extremely likely (5, Red)**: Almost certain to occur without immediate intervention. ### Impact Scale (1 to 5) Evaluates the severity of consequences across financial, educational, reputational, or safety dimensions: * **Slight impact (1, Blue)**: Minor operational inconvenience; negligible financial or educational consequence. * **Moderate impact (2, Green)**: Localised disruption managed through normal day-to-day contingency measures. * **Significant impact (3, Yellow)**: Measurable disruption to teaching, adverse local publicity, or moderate budget variance. * **Severe impact (4, Orange)**: Serious disruption, potential regulatory sanction, major budget impact, or critical safety incident. * **Extreme impact (5, Red)**: Catastrophic impact, prolonged school closure, major statutory breach, or existential threat. ### Calculated Composite Risk Level (0 to 10) The overall risk level is automatically calculated as the sum of Likelihood and Impact (`Likelihood + Impact = Risk Level`): | Level Score | Banding | Status Colour | Interpretation & Governance Action | | :-: | :- | :- | :- | | **0 – 1** | *Not Set* | Gray | Initial entry; likelihood or impact not yet evaluated. | | **2 – 3** | *Minimal* | Blue | Low risk; manageable with standard routine controls and minimal monitoring. | | **4 – 5** | *Low* | Green | Acceptable risk; routine operational controls and periodic review sufficient. | | **6** | *Moderate* | Yellow | Notable risk; active monitoring required by item owners and area leads. | | **7 – 8** | *Significant* | Orange | Substantial risk; requires structured mitigations and senior leadership review. | | **9 – 10** | *High* | Red | Critical risk; demands immediate mitigation, executive oversight, and board reporting. | *** ## The 4Ts Strategic Response Framework The module embeds the widely recognised **4Ts Risk Response Framework** (established in public sector governance and HM Treasury guidance) to categorise how school leaders address each risk: ```mermaid theme={null} flowchart TD StartRisk["Identified School Risk"] --> Decision{"Determine Management Strategy"} Decision -->|Reduce probability / severity| Treat["Treat (Default Approach)
Implement internal control measures and safeguards to reduce likelihood or impact."] Decision -->|Accept residual risk| Tolerate["Tolerate
Retain and accept the risk where existing controls are optimal or cost of further control outweighs benefit."] Decision -->|Share or insure| Transfer["Transfer
Share or pass financial/operational consequence to a third party (e.g. insurance, outsourcing)."] Decision -->|Cease activity| Terminate["Terminate
Eliminate the risk entirely by ceasing the activity, event, or practice giving rise to it."] ``` * **Treat (Default)**: The standard approach for the vast majority of school risks. Leaders implement specific internal control measures (e.g., enhanced staff training, dual-authorisation finance limits, visitor badge systems) to reduce likelihood or severity. * **Tolerate**: Used when a risk cannot be further mitigated at reasonable cost, or where the residual risk is deemed acceptable within the school's risk appetite (e.g., minor fluctuations in utility costs). * **Transfer**: Used when the risk can be effectively shared or offloaded to a third party (e.g., comprehensive RPA/commercial insurance cover, contracting external specialist contractors for high-voltage maintenance). * **Terminate**: Used when the risk is unacceptably high and cannot be treated or transferred cost-effectively, requiring the school to cancel or fundamentally alter the activity (e.g., canceling a high-risk excursion or decommissioning obsolete equipment). *** ## Management Scopes (Multi-Tier & MAT) To reflect multi-academy trust and federation governance models, each risk item can be classified by its management tier: * **School**: Managed locally by school-level staff, business managers, or heads of department. * **Central**: Managed centrally by trust executive teams, central finance leads, or the local authority. * **School & central (Both)**: Shared accountability between central trust leaders and local academy staff. * **Unmanaged**: Newly identified or orphaned items requiring management level assignment. *** ## Roles & Permissions Matrix The module provides role-based access control to ensure appropriate segregation of duties, delegation of risk mitigations, and read-only transparency for governance boards and auditors: > [tab] Administrator > > **System Setup & Global Governance** > > * Enable or disable the Risk Register module in tenant administration. > * Assign the `Risk Register Manager` role to designated senior leaders. > * Automatically receive system alerts if the module is enabled without an active manager. > * Full system-wide access to view, update, manage, or delete any risk area or item. > [tab] Risk Register Manager > > **Module Leadership & Configuration** > > * Access the administration hub at `/risk/admin/areas`. > * Configure the school key abbreviation (e.g. `SCH`) used for item identifiers. > * Create, edit, reorder via drag-and-drop, archive, and delete risk areas and items. > * Delegate and reassign ownership of entire risk areas or individual risk items. > * Grant and revoke `Risk Register Owner` and `Risk Register Viewer` roles. > * Receive automated weekly alerts regarding orphaned risk items (ghost owners) or unrated risks. > * Export comprehensive A3 landscape PDF registers for trust boards and governing bodies. > [tab] Risk Register Owner > > **Risk Mitigation & Control Management** > > * Access the main Risk Register workspace at `/risk/register`. > * Update assigned risk items, edit descriptions, and document control measures. > * Evaluate and adjust Likelihood and Impact scores before and after treatment. > * Classify response strategies (4Ts) and management scopes. > * Record governance notes and contextual commentary to explain risk level changes. > * Receive automated weekly email reminders for unrated risk items. > [tab] Risk Register Viewer > > **Governance, Oversight & Auditing** > > * Read-only access to the main Risk Register workspace at `/risk/register`. > * Inspect individual risk items, control measures, governance comments, and revision histories. > * Export and stream official A3 landscape PDF registers for committee papers and inspection packs. > * Cannot modify risk descriptions, alter scores, or reassign ownership. *** ## Operational Screen Tour ### 1. Main Risk Register (`/risk/register`) The primary operational hub for staff, managers, and governors: * **Progress & Category Grouping**: View all active risk items ordered by risk area. * **Live Search & Filter**: Rapidly search risks by description or keyword. * **Visual Status Indicators**: Left-border colour badges and colour-coded triple-circle indicators (`Likelihood`, `Impact`, `Level`) display pre- and post-treatment risk at a glance. * **Row Actions & Dropdown**: Open detailed view, edit in modal, inspect revision history, or archive items. * **Bulk Action Bar**: Select multiple items to reassign owners, change risk areas, or archive. * **A3 Landscape PDF Export**: Generate a publication-ready A3 PDF register formatted for governing body and trust board review. ### 2. Risk Item Detail (`/risk/item/{item}`) An interactive management card providing complete detail for an individual risk: * **Key Code & Identification**: Displays the unique school identifier (e.g. `SCH001`) and lock indicator if centrally managed. * **In-Place Modal Editing**: Click to update Description, Controls, and Commentary with instant saving and activity logging. * **Dual Matrix Controls**: Select Likelihood and Impact from colour-coded dropdowns before and after control measures, with instant recalculation of composite Risk Levels. * **4Ts Response & Management Scope**: Select the strategic response (*Treat*, *Tolerate*, *Transfer*, *Terminate*) and management tier (*School*, *Central*, *School & central*). * **Owner Assignment**: Reassign the risk to any active staff member holding the `Risk Register Owner` role. ### 3. Item Revision History (`/risk/item/{item}/history`) A complete, immutable audit trail for governance transparency: * Lists every historical update in reverse chronological order. * Details the date of modification, the staff member who made the update, and the exact changes applied (e.g. description updates, score changes, revised control text, or ownership transfers). ### 4. Area & Key Administration (`/risk/admin/areas`) Accessible to `Risk Register Managers` and `Administrators`: * **Area Management**: Create custom risk categories, edit names, and delete unused categories (safeguarded against deleting areas containing active items). * **Drag-and-Drop Reordering**: Rearrange risk areas to match school committee structures. * **School Key Prefix Configuration**: Set the short prefix used to generate unique item codes (e.g., `SCH`, `PRI`, `ACAD`). * **Active vs Archived Views**: Toggle between active areas and archived records. ### 5. Role Management (`/risk/admin/owners`, `/risk/admin/viewers`) Dedicated management views to delegate risk responsibilities across school staff and governance boards without navigating away from the module. *** ## Automated Notification Schedule The Risk Register module maintains institutional accountability through automated background notifications: | Notification | Recipient | Trigger / Schedule | Content & Purpose | | :- | :- | :- | :- | | **Weekly Unrated Risk Reminder** (`RiskReminder`) | `Risk Register Owners` | Weekly | Alerts owners who have assigned risk items where likelihood or impact scores have not yet been evaluated (unrated). | | **Missing Manager Alert** (`RiskManagerMissing`) | `Administrators` | Weekly | Alerts tenant administrators when the Risk Register module is enabled but no active staff member is assigned the `Risk Register Manager` role. | | **Ghost Owner Alert** (`RiskGhostReminder`) | `Risk Register Managers` | Weekly | Flags risk areas or items assigned to inactive, unverified, or deactivated staff accounts, prompting immediate reassignment. | *** ## Multi-Academy Trust (MAT) & Central Coordination For Multi-Academy Trusts, federations, and diocesan groups: * **Centrally Defined Risk Areas & Items**: Trust executive teams can create standardised risk templates in the central trust tenant. * **Automated Trust-Wide Synchronisation**: The `sync:risk` console command propagates central areas and items to all academy schools, applying matching IDs and locking structural fields against local alteration. * **Local Ownership & Contextual Controls**: Academies retain full flexibility to assign local risk owners, evaluate school-specific likelihood and impact, tailor operational control measures, and add local governance commentary. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.