Skip to main content

​
End-to-End Risk Register Lifecycle

The Risk Register module coordinates strategic and operational risk management through systematic hazard identification, dual-matrix scoring (inherent vs. residual risk), the 4Ts treatment framework, and Multi-Academy Trust (MAT) template synchronisation.

​
1. Risk Formulation & Dual-Matrix Scoring

Risk Owners document risks using an objective dual-assessment scoring model:
1

Record Inherent Risk (Pre-Treatment)

Evaluate the risk in its unmitigated state:
  • Likelihood Before: Probability of occurrence on a 1–5 scale (Rare to Extremely likely).
  • Impact Before: Severity of consequence across finance, operations, or reputation (Slight to Extreme).
  • The system sums the two ratings to calculate the Inherent Risk Level (2 to 10).
2

Select Strategic Response (4Ts)

Determine the appropriate governance strategy:
  • Treat: Introduce operational procedures, physical controls, or training to reduce probability/impact.
  • Tolerate: Retain risk when controls are optimal or cost of further intervention is disproportionate.
  • Transfer: Mitigate exposure through commercial insurance policies or specialist contractors.
  • Terminate: Cease the operational activity or system creating the vulnerability.
3

Record Control Measures & Residual Score

Document detailed mitigation measures in the controls commentary. Re-evaluate Likelihood After and Impact After to record the calibrated Residual Risk Level.

​
2. Risk Level Thresholds & Bandings

  • High Risk (9–10, Red): Demands immediate executive intervention, priority resource allocation, and formal reporting to governors.
  • Significant Risk (7–8, Orange): Requires structured preventative controls and termly monitoring by senior leadership.
  • Moderate Risk (6, Yellow): Routine monitoring by area owners.
  • Low / Minimal Risk (2–5, Green/Blue): Managed through standard operational procedures.

​
3. Governance Reporting & MAT Synchronisation

School leadership and audit committees maintain oversight through reporting facilities:
Click Export PDF from the master register to generate a clean, board-formatted A3 PDF report displaying risk key codes, pre/post scores, 4Ts classifications, and control commentary.
In academy trusts, central teams author baseline trust risk templates. Centrally synced risks feature a lock badge and update automatically across all academies.
Risks can be classified as School Managed, Centrally Managed, or Both, clarifying jurisdictional accountability across multi-academy trusts.