Why risk registers go stale faster than anyone notices
Your risk register records what you typed, not what your evidence does. Here is why the heat map and the self-scored residual survive, and what an honest, evidence-backed register looks like instead.
The risk register is the most trusted document in the building, and the score on each row does not tell you whether the assessment behind it still holds.
Nobody sat down to mislead the board. The register goes stale the way a weather forecast from last month goes stale. It was a reasonable account of how someone saw the world on the day they typed it, and it has been quietly diverging from what is true ever since. The dangerous part is that it does not look like an opinion. It looks like a measurement. Rows, scores, a colour. The form of the thing borrows all the authority of evidence while carrying none of the obligation.
The register records assertions, not evidence
Open a typical register and read what is actually in each cell. A likelihood somebody chose. An impact somebody chose. A residual score somebody chose after asserting that a control they also described is working. Every number on the page is a self-report, and the document treats the self-report as the finding.
This is why a register is so hard to argue with. It is unfalsifiable by construction. There is no evidence attached that could turn out to be stale, no dependency that could turn out to be unowned, no assumption that could turn out to be wrong, because the register never claimed any of those things. It only claimed that, in someone’s judgement, the residual was medium. You cannot disprove a feeling.
The heat map can be worse than no map
The coloured grid deserves its own paragraph, because it is the part everyone trusts most and defends least.
In 2008 Tony Cox published What’s Wrong with Risk Matrices? and demonstrated, formally, that the matrix can rank a quantitatively smaller risk above a larger one, that its categories compress wildly different exposures into the same square, and that, under the conditions he identifies, its rankings can be worse than random. Douglas Hubbard, in The Failure of Risk Management, made the companion point about the scores feeding the grid: ordinal scales (your 1-to-5s) add measurable noise, manufacture an illusion of communication between people who quietly mean different things by “likely”, and carry no objective evidence that they improve on the unaided guess they were meant to discipline, while introducing error of their own.
The FAIR community makes the same case from the other side: risk is a measurable quantity, a distribution of probable loss, and the moment you are willing to express it that way, the coloured grid has nothing left to contribute. A heat map is not a simpler version of the analysis. It stands in for an analysis that has not been done.
A method that produces a confident colour from two arbitrary guesses is not a measurement. It is a guess wearing the costume of one.
The heat map persists anyway, for the same reason the static green dashboard persists: it resolves discomfort. It takes a hard, contested, evidence-hungry question and returns a tidy amber square that lets everyone move on. That is precisely the property we refuse to ship.
Why a stale register is comfortable
The incentives here are not subtle. A register that can be curated by hand is a register that can be made to look better before a board meeting. A residual you score yourself is a residual you can improve without doing anything. A heat map is a slide that closes the agenda item. None of this requires bad faith. It only requires a tool that rewards the appearance of control over the fact of it. A register you can edit by hand is exactly that tool.
Your incidents already say what happened
Here is the part the register cannot survive: everything you would need to check it against, you usually already have. The register can claim a treatment is working while the change record shows it stalled months ago. It can claim a risk is accepted after the acceptance’s own review window has lapsed. It can claim a residual dropped from high to medium while the incident log shows the same control still failing. The register says what you typed. Your incidents say what happened, and nothing in the register makes the two agree.
That reconciliation is the whole job. A register nobody checks against reality is not a control, it is a diary. The honest version runs the check continuously and says the disagreement out loud instead of smoothing it over.
What an honest register looks like
So we built the opposite, and we were strict about it.
Frank does risk, but it does not borrow the incumbent’s vocabulary. Risk is a read-only lens, not a document you maintain by hand. Each risk domain is computed from the obligations, commitments, decisions, debts, and assumptions already under assurance. You do not type it in, and there is no field to curate. It is derived from what is already true, or it does not appear at all.
Three things it refuses to do, on principle:
- No heat map. Frank publishes posture with an expiry,
Holds through YYYY-MM-DD, not a quadrant. Confidence is a window, not a colour. - No credit for a self-reported residual. A number you assigned yourself is an opinion, and Frank credits neither the number nor the optimism behind it. Only the evidence moves the posture.
- No curating the register in the app. If you could hand-edit it, it would say what you typed again. It is computed from what you can prove, or it does not exist.
These are not gaps we are apologising for. They are the product.
The pay-off is that the register stops being a document and becomes a claim: the same coverage assertion Frank publishes for everything else, carrying a named authority, the evidence behind it, the debts weighing on it, and a date after which it no longer stands. Anyone who has to rely on it can check it rather than take it on trust.
Ask it the one question it cannot answer
Take any row in your register and ask what would have to be true for it to be wrong, and whether the document would tell you if it were. Most rows have no answer to that, because nothing in them was ever pointed at anything checkable. A register in that state has stopped recording risk and started recording how someone felt on the day they typed it, in a format that makes feelings look like findings.
You can see what the honest version says about your own scope. Start by seeing where you stand. There is no score at the end of it and no heat map, just a list of what your evidence currently supports and a list of what it doesn’t.