A risk register that keeps pace with the business.

Arukus Enterprise Risk Management connects the initial assessment with ongoing monitoring. The scoring model uses probability and maximum impact to calculate a score on a 1–25 grid. Changes to either input recalculate the score, making movement visible rather than leaving the original assessment untouched.

Record the inherent risk and the target the organisation intends to reach. Review the current score alongside the measures underway, so that a lower number can be examined in context rather than accepted without explanation.

Each key risk indicator has an owner, thresholds and a current value. Values can be entered by the responsible user or calculated from enterprise-system parameters through agreed integrations and predefined ranges.

When a manually updated value falls outside its permitted range, the application flags a breach. The KRI owner can explain the root cause and record corrective action. Risk owners manage changes in impact, keeping responsibility for the assessment explicit.

• Review assigned KRIs and their acceptance status.
• Identify indicators awaiting review.
• Examine threshold breaches alongside the explanation.
• Agree data sources, update frequency and ownership before connecting operational systems.

A mitigation plan describes work being undertaken to address a risk. A control describes the measure expected to keep exposure within an acceptable level. They need different conversations, even when the same people contribute to both.

Track mitigation dates, monitoring frequency, progress and remarks. For controls, assign a primary responsible person and review effectiveness on a 0–100 scale. Status indicators help reviewers locate weak or incomplete measures without reading every entry in full.

Related risks can also be linked to the main risk. That relationship helps teams examine whether a change in one process could alter the probability or impact elsewhere.

Reports cover risks by score and department, contributing factors, root-cause analysis, risk trends and timeline breaches. Leadership can start with an organisation-wide view, then examine the risks and responsibilities behind it.

The configuration includes departments, locations, user groups, risk classes, processes, impact areas, strategies and KRI masters. Arukus has financial-services experience, but these concepts also apply to insurance, manufacturing, retail groups and service organisations. The assessment must use each organisation’s own terminology, ownership and risk appetite.

Bring a sample risk register, a KRI catalogue and one recent review pack. We can map the scoring method, responsibilities and reporting needs against the product. This is the point to identify configuration changes and interfaces, rather than assuming a familiar-looking grid means the underlying methodology is the same.