How to create a risk register on Mac
You can do this with RiskOS, a risk register for macOS. One risk written properly, two settings agreed, and a backup before you close the lid.
Most registers get started twice. The first attempt collects forty rows nobody has rated and quietly stops being opened; the second one survives, because somebody decided what a score meant before they filled anything in. The difference is about twenty minutes spent on a single risk and two settings.
Everything here happens on your Mac. There is no account, nothing is uploaded, and your register never leaves the machine.
Where your register lives
RiskOS is one window. The sidebar chooses a section: Profiles and Dashboard at the top, then Register (Risks, Controls, Actions, Review), Signals (Indicators, Events), Inventory (Assets, Vendors), Reference (Frameworks, Risk Library) and Output (Reports, Import & Export, Settings). Your register is the Risks section; everything else in that list exists to support or explain it.
Every section works the same way. A list sits in the middle and a panel on the right shows and edits whatever you have selected. ⌘N creates the right kind of item for the section you are in, every list is searchable, and ⌘Z undoes whatever you last did.
Build your first register, step by step
-
Create your first risk
Choose Risks in the sidebar and press ⌘N. A new row pins to the top of the table with the reference RSK-0001 already assigned, and the panel on the right opens on it. References are issued in order and never reissued, so that number identifies this risk in every report you produce from now on.
-
Write the risk as an event, not a topic
Give it a one-line title that names what happens rather than the subject it belongs to — Backup restoration has never been tested end to end rather than Backups. Add a short description of what would actually go wrong and who would feel it.
A vague title is the commonest reason two people later rate the same risk differently. Changes save as you type, so there is nothing to confirm.
-
Fill in the summary fields
Under Summary, set the status, the category — from the seeded list or one of your own — an optional subcategory, the owner and the business unit. An owner is a person, not a department: the point of the field is that somebody can be asked about the row.
Set a review cadence at the same time. The next review date follows from it, which is what stops a register ageing without anyone noticing.
-
Rate the inherent likelihood and impact
Open Assessment and set likelihood and impact on the two segmented steppers, each running 1 to 5 with its scale label beside it. Rate the risk as it would be with nothing standing in its way; controls come next and are recorded separately.
The score appears at once — likelihood multiplied by impact, 1 to 25 — with its band named beside it, and the matrix moves its inherent marker into the cell you chose.
-
Link the control you already rely on
Open Controls in the panel and use the picker to link an existing control or create one on the spot. Give it a status honestly, because only controls that are implemented or operating reduce risk — a planned control, however strong it will be one day, reduces nothing yet.
With derive effectiveness from linked controls switched on, the residual score follows your strongest operating control, and the matrix gains a second marker so the distance between exposure and reality is visible rather than asserted.
-
Set a target and choose a treatment
Set the target likelihood and impact you intend to reach, then open Treatment and choose Mitigate, Accept, Transfer or Avoid, with a plan and a due date. A target is a statement of intent, and it is what turns a register into a piece of work rather than a list.
The comparison grid then shows inherent, residual, target and the gap between them, with a line telling you what strength of control would close it.
-
Agree the methodology before the second risk
Press ⌘, and open Settings ▸ Methodology. It holds the scoring scales, the band thresholds, and the one choice that changes arithmetic across the register: whether controls reduce likelihood, impact or both.
Decide it now, while the register holds a single risk. Changing it later re-scores every risk immediately, which is the right behaviour but an odd thing to watch the week before a board meeting.
-
Set the appetite the register will hold you to
In Settings ▸ Appetite, set the highest residual score your organisation is willing to carry. Anything above it is flagged wherever it appears — in the table, on the dashboard and in the reports you produce from it.
If one area warrants less tolerance than the rest, give that category its own threshold and write the rationale beside it. A threshold with a reason attached survives a change of personnel.
-
Back the register up before you close the lid
Choose File ▸ Back Up RiskOS… or press ⇧⌘B. RiskOS writes a single file carrying everything: risks, history, the audit trail, controls, actions, assets, vendors, frameworks, indicators, events and settings.
Save it somewhere you will find it again, such as Documents ▸ RiskOS. The filename RiskOS suggests carries the date, like Risk Register 2026-09-21, so a folder of backups reads in order.
The fields that earn their place on day one
A risk panel offers a great deal. On a first pass, seven fields carry nearly all of the value, and each pays you back in something you will want later.
| Field | What you put in it | What it gives back |
|---|---|---|
| Reference | Nothing — RiskOS issues RSK-0001 onwards | A stable name for the risk in every report and conversation |
| Title and description | The event, and what would actually happen | Two people rating the same risk the same way |
| Category | Seeded list, or your own | Grouping, filtering, and a per-category appetite later |
| Owner | A named person | Everything one person holds, in one search |
| Inherent likelihood and impact | Two ratings, 1 to 5 | The score, the band and the matrix position |
| Linked controls | What you actually rely on | A residual score with an argument behind it |
| Review cadence | How often this should be looked at | A next review date, and a queue that fills itself |
Leave the rest until it is needed
Subcategory, business unit, onset velocity, detectability, an exposure amount, linked assets, vendors, indicators and events are all there, and each is worth having on the risks that warrant it. None of them should hold up a first pass. Add ten risks with seven fields each, then go back for the depth where the score says it matters.
The scales behind the score
The register scores on a 5×5 methodology. Likelihood runs Rare, Unlikely, Possible, Likely and Almost Certain. Impact runs Insignificant, Minor, Moderate, Major and Severe. Multiply the two and you get a score from 1 to 25, banded as Low 1–4, Medium 5–9, High 10–16 and Critical 17–25.
Five points is coarse, and deliberately so. A rating is a judgement made out loud, and five steps are few enough that two people can settle on one. What matters far more is that everyone reads those five points the same way, so pick a fixed window for likelihood — a year is the usual choice — and anchor each impact rating to something concrete before you add the second risk.
Whether controls reduce likelihood, impact or both
This is the methodology choice worth five minutes of thought. A control that stops an event happening reduces likelihood; one that limits the damage reduces impact. Many organisations hold that controls do both, and RiskOS applies whichever rule you choose to every risk consistently. Residual can never exceed inherent, never falls below 1, and a stronger control never raises a score.
How appetite is resolved
Appetite is the highest residual score you are willing to carry. It can be set in three places, and the most specific setting wins.
| Order | Where it is set | When it applies |
|---|---|---|
| 1 | The risk's own override | Whenever the override is switched on in that risk's panel |
| 2 | The category threshold | When the risk's category carries its own threshold and rationale |
| 3 | The organisation threshold | The default for everything else in the register |
| 4 | None | With no threshold set at all, nothing is flagged as a breach |
Filling the register without typing every row
Ten well-written risks are worth more than sixty imported ones. There are two honest shortcuts, and both leave you with rows you can defend.
Start from a worked example
Open Risk Library. It holds thirty-nine worked example risks across seven categories — cybersecurity, cloud, third-party and vendor, business continuity, project delivery, compliance and regulatory, and artificial intelligence — each with a suggested starting rating, a typical treatment and the controls usually worth considering.
Entries arrive in your register as drafts, and the detail view confirms the reference, such as Added as RSK-0042. The suggested ratings are a starting point for your own assessment, never an authority.
Bring an existing list in
If your risks already exist as a CSV, choose Import & Export. Importing always shows a preview first: line by line, what will be created, updated or skipped, the projected score for each row, any problems, and any columns it ignored. Nothing is written until you confirm, and controls, assets and vendors import the same way.
One rule is worth knowing beforehand. Scores are never read from a file — RiskOS recalculates every one of them from the ratings and the controls.
Keeping the register safe
A register becomes valuable the moment it holds history, which is exactly when losing it would hurt. Restore from Backup… replaces the register with the contents of a backup after telling you what that means and asking you to confirm. Backups are versioned: an older one always restores, and a file from a newer version of RiskOS is refused rather than half-read.
Choosing a reminder interval
A quiet reminder appears when a backup is getting old. The interval is yours, and the right answer depends on how much work a week of your register represents.
| Interval | Suits |
|---|---|
| Weekly | An active register being built out, or one under review |
| Fortnightly | A settled register with regular treatment work against it |
| Monthly | A stable register touched mainly at review time |
| Never | Anyone who would rather remember it themselves |
Troubleshooting
My residual score is the same as my inherent score
Nothing linked to the risk is reducing it yet. Open the risk's Controls section and check that at least one control is linked and that its status is implemented or operating. Only those reduce a score. A planned control reduces nothing until its status says otherwise, and RiskOS says so in the panel rather than leaving you to guess.
I cannot find a risk I know I added
Check whether a filter is on — the filter icon fills when it is. Closed and accepted risks stay hidden until you switch them back on, and a band filter hides everything outside it. Search covers title, reference, category, owner, detail and tags, so the owner's name is usually the fastest way back to a row.
Every risk I add comes out High
That is impact inflation, and it happens to nearly every new register. If most rows sit at Major or Severe, the scale has stopped separating anything. Re-read what you meant by each impact point, re-rate your three smallest risks first, and let the rest settle around them.
I changed one setting and every score moved
That is intended. Changing whether controls reduce likelihood, impact or both re-scores the whole register at once, so no risk is left rated under a rule you have abandoned. Your inherent ratings are untouched; only the residual arithmetic changes.
I added the same risk twice
Close the duplicate rather than looking for a way to delete it. Risks are closed, never deleted, so the reference stays spoken for and the history stays intact. Closed rows leave the table until you switch show closed back on.
A routine for the first month
The first twenty minutes get you a register. These habits are what make it worth opening in March.
- Add risks in tens, not hundreds. Ten rated, owned rows beat sixty unrated ones, and they are what a first report can be built from.
- Always rate inherent. Set the exposure, link the controls, and let the residual be calculated. A hand-typed residual is the first thing anyone will pull on.
- Give every risk a name to answer for it. Owner is the field that turns a register into a set of commitments.
- Set the cadence on the day you write the risk. The next review date schedules itself, and the review queue then fills without anybody maintaining a list.
- Read the dashboard once a week. Risks above appetite, reviews that have fallen overdue and actions past their due date are counted for you, so a weekly glance is usually enough to catch what has moved.
- Run a review pass at the end of the month. Review walks the risks that are due, one at a time, worst first, with full context beside the scoring inputs.
- Export once, early. Produce a report while the register is small, so you find out what it looks like on paper before it matters.
- Back up around anything large. An import, a methodology change or a review pass each deserve a file on either side of them.
Frequently asked questions
How do I start a risk register on a Mac?
Open RiskOS, choose Risks in the sidebar and press ⌘N. Write the risk as an event, rate its inherent likelihood and impact on the two 1–5 steppers, set an owner and a review cadence, and link the control you rely on. That single row is a working register; everything after it is repetition.
How many risks should a risk register have?
Fewer than most people expect. A register of ten to thirty active risks, each owned, rated and reviewed on a cadence, is more useful than one of two hundred that nobody maintains. Add the risks a senior person would recognise as real, and let each review pass tell you what is missing.
What is the difference between inherent and residual risk?
Inherent is the exposure with nothing standing in its way, and it is the only pair of ratings you set yourself. Residual is what remains once the controls you have linked are taken into account, and it is calculated for you. A target states where you intend to get to. The gap between residual and target is the work.
Do I need to set a risk appetite straight away?
Set the organisation-wide threshold early, because it costs one number and immediately flags anything above it across the table, the dashboard and your reports. Per-category thresholds can wait until you know which areas warrant less tolerance. With no threshold set at all, nothing is flagged as a breach, which is a quiet way to lose the signal.
Can I import an existing risk register?
Yes, from CSV, and the preview shows line by line what will be created, updated or skipped, with the projected score and any problems, before anything is written. Controls, assets and vendors import the same way. Scores themselves are never read from a file — RiskOS recalculates every one from the ratings and the controls.
How do I back up a risk register?
In RiskOS, choose File ▸ Back Up RiskOS… or press ⇧⌘B. One file carries risks, history, the audit trail, controls, actions, assets, vendors, frameworks, indicators, events and settings, saved wherever you choose. The default filename carries the date. A quiet reminder appears when your last backup is getting old, at whatever interval you set.
Can I delete a risk I added by mistake?
Risks are closed rather than deleted, so a reference is never reissued and the history behind a row stays intact. Closing hides it from the table until you switch on show closed, which keeps the working view clean. For a mistake made seconds ago, ⌘Z undoes it outright.
How long does it take to set up a risk register?
About twenty minutes for a first risk done properly, including the two settings behind it: the methodology and the appetite threshold. Each risk after that takes two or three minutes. Seeding from the risk library is faster still, though those entries arrive as drafts and need rating against your own scale before they count.