How to find risks with no controls on Mac
A gap is not hidden in RiskOS. Where nothing is taking points off a risk, two columns sitting side by side say so, and one pass down the table finds every one.
Capture is the easy half of risk management. A register fills up in an afternoon, and treatment falls behind it almost immediately: a row gets a title, a rating, an owner and a review date, and then never gets a control. Those rows are the expensive ones. They carry their full exposure while looking as settled as everything around them, and they tend to surface in the worst possible room.
A risk with no controls is not automatically a failure. Accepting an exposure is a legitimate decision, and it is recorded like any other. What is not defensible is a gap nobody has looked at, sitting in a register that implies somebody has.
Where the gap shows up
Choose Risks in the sidebar. The table carries Inherent and Residual as adjacent columns, and the relationship between those two numbers is the whole trick. Residual is what is left after the controls you rely on are taken into account. Where no control is operating, there is nothing to take off, so residual has nowhere to fall and sits level with inherent. A row showing the same figure twice is a row nothing is reducing.
The definitive answer for a single risk lives one click to the right. Select a row and open Controls in the panel: it holds the derive-from-controls toggle, the list of every linked control with its status and effectiveness, an unlink control for each, and a picker that links an existing control or creates a new one. An empty list is exactly what it looks like.
A third view reads the same gap from the other end. Choose Controls in the sidebar: the table carries a Risks count column, so the controls attached to nothing are one sort away.
Find the uncontrolled risks, step by step
-
Start from the whole active register
Choose Risks in the sidebar and clear the filters before you begin, so the count in front of you means what you think it means. Leave show closed and accepted switched off: closed risks are kept rather than deleted, and a pass looking for missing treatment does not want them padding the list. The filter icon fills whenever a filter is on, so you can tell at a glance whether you are looking at everything.
-
Put Inherent and Residual side by side
Right-click the table header to show, hide and reorder columns. For this pass you want Ref, Risk, Inherent, Residual and Owner, and little else — hiding Trend, Target and Review for a few minutes makes the comparison you are actually making much easier to see. RiskOS remembers the arrangement, so you can set it up once and come back to it.
-
Sort by the inherent score
Click the Inherent header to sort by raw exposure, highest first. An uncontrolled risk rated 20 and an uncontrolled risk rated 4 are not the same problem, and working down from the top makes the first ten minutes of the pass the ten that matter.
-
Look for rows where the two numbers match
Read down the pair of columns. Wherever Residual equals Inherent, nothing operating is taking points off that risk. A row such as RSK-0012, Legacy authentication service reaches end of support, showing the same figure in both columns, is carrying its full exposure today whatever the treatment field says.
Note the references as you go rather than fixing each one on the spot. A scan and a fix are different jobs, and mixing them is how half a register gets reviewed.
-
Open each candidate and check its Controls section
Select the row and open Controls in the panel. You will find one of two things: an empty list, which is a true gap, or a list where everything linked is planned rather than operating, which reduces nothing yet and is the more common of the two. The status and effectiveness of every linked control are shown in the list, so you do not have to open each one to find out.
-
Check the rows that look controlled
A residual score below inherent is not proof that a control exists. Effectiveness can be set by hand rather than derived, and a hand-set value lowers the score with nothing linked behind it. Open Controls on your highest-scoring risks and confirm the reduction has something attached to it. Where a hand-set value disagrees with the linked controls, the panel points that out rather than quietly picking one.
-
Narrow the list to what matters first
Turn on the band filter for High and Critical, and switch on over-appetite only. What is left is the intersection you care about most: severe risks, above the threshold your organisation has agreed to tolerate, with nothing reducing them. On a register of twelve active risks, four of which sit above appetite, that is a short and workable list.
Use Save Current Filter… to name the combination — something plain like Above appetite, high and critical — so the same question takes one click next month instead of three.
-
Close the gap, or record the decision
From the risk's Controls section, use the picker to link a control you already have or to create one on the spot. If the honest answer is that nothing is being done yet, say so properly: set the strategy in Treatment, write the plan, give it a due date and add an action with an owner. Changes save as you type, and every scoring change that follows is kept in History.
What each kind of gap looks like
Not every row you flag in that pass is the same problem, and the remedies differ enough to be worth separating before you start.
| What the row shows | What it means | What to do |
|---|---|---|
| Residual equals inherent, nothing linked | A true gap. Nothing in the register is reducing this risk. | Link or create a control, or record an explicit decision to accept it. |
| Residual equals inherent, controls linked | Everything linked is planned or retired, so none of it counts yet. | Open the control, set its status when it is genuinely running, and the risk re-scores. |
| Residual below inherent, nothing linked | Effectiveness was set by hand rather than derived. | Link what you rely on, or keep the value and write the evidence into the risk's description. |
| Residual below inherent, still above appetite | The controls work. They are not enough on their own. | Set a target and read what strength of control would reach it. |
| Treatment set to Mitigate, no actions | A decision with nothing behind it. | Add an action with an owner and a due date, so it appears in the Actions list. |
The planned control trap
This is the one that catches most registers, and it looks like diligence rather than a gap. Take RSK-0007, Backup restoration has never been tested end to end, rated 20 inherent against a residual of 15. Two controls are linked: CTL-0002 Immutable offsite backups, operating at moderate effectiveness, and CTL-0003 Quarterly restore rehearsal, which is high but still planned. Only the operating one is taking points off. The rehearsal will help a great deal on the day it starts running, and until then it helps not at all. RiskOS scores status, never intent.
| Control status | Reduces risk? | Why |
|---|---|---|
| Planned | No | It does not exist yet. Strength it will have one day changes nothing today. |
| Implemented | Yes | It is in place, and counts towards the residual score. |
| Operating | Yes | It is in place and running. This is the state a residual score should rest on. |
| Retired | No | It has been withdrawn. Retired controls are hidden behind a toggle on the Controls list. |
Editing a control's status re-scores every risk that derives from it, immediately and everywhere. Finishing an implementation and marking it operating is often the single fastest improvement available to a register, because one edit moves several rows.
Reading it from the controls side
The same gap has a mirror image, and it is quicker to check than most people expect. Choose Controls in the sidebar and sort by the Risks column, lowest first. Every control showing zero is doing no work in your register. Sometimes that is real: the control guards something you never wrote down as a risk. More often the link was never made, and one click from the risk's panel credits work you are already doing.
A type filter and a show-retired toggle sit above that table, so the view stays on the controls meant to be carrying weight. Working both directions in one sitting is what closes the gap properly: the risks with nothing linked, and the controls linked to nothing, are two halves of the same missing connection.
The same question, asked of a framework
Choose Frameworks and the question becomes one of coverage rather than scores. Each requirement reads as covered, mapped but not operating, or not mapped, and the middle state is the framework's version of the planned control trap: work has been claimed, nothing is running. Filter by coverage to bring the gaps together, and remember that the coverage figure moves when a control's status does, not when a mapping is added.
A review pass that catches what a sort misses
Scanning columns finds missing controls. It does not find controls that are linked, operating and quietly wrong for the risk. For that, choose Review and set the scope to All active risks. Risks arrive one at a time, worst first, with the full context on one screen: owner, actions, linked controls and the last review, beside the scoring inputs.
Work the queue with the keyboard. ⇧⌘↩ confirms a risk as it stands, ↩ saves a change and moves on, ⌘→ skips and ⌘← goes back. Skipping leaves the risk completely untouched, which matters here: anything you are not ready to decide about stays in the next pass rather than being quietly stamped as reviewed. The session survives leaving for another section, so you can link a control and come back.
When no control is the right answer
Some risks should not be controlled. Treatment can cost more than the exposure, the exposure can sit comfortably inside what your organisation tolerates, or the sensible move can be to transfer it or stop doing the thing entirely. Each of those is a choice, and the register has a field for it: Mitigate, Accept, Transfer and Avoid, with a plan and a due date beside them.
Risk appetite is what turns that from an opinion into a rule. The threshold set in Settings is the highest residual score you tolerate, any category can carry its own threshold and rationale, and an individual risk can override both. A risk below appetite with nothing reducing it is a defensible position, as long as somebody wrote down that it was a position. Above appetite it is different: RiskOS flags the breach everywhere the risk appears, and that flag is the one to work from.
Troubleshooting
A risk I know has controls shows no reduction
Open its Controls section and read the statuses. Almost always everything linked is still planned, and a planned control takes nothing off however strong it will be. The other possibility is that a hand-set effectiveness is standing in for the linked list, in which case the panel flags the disagreement.
I linked a control and the score did not move
Three things to check, in order. The control's status, which must be implemented or operating. Whether the risk is deriving effectiveness from its linked controls at all. And whether the control you linked is weaker than one already linked — the derived value follows the strongest operating control, so adding a second moderate control to a risk that already has a high one changes nothing.
The gap list is too long to act on
Filter rather than triage by eye. Band set to High and Critical, plus over-appetite only, cuts most registers to a handful of rows, and that handful is the right place to start. Save the combination and let the rest wait for the quarterly pass.
A risk I expected to see is missing from the list
Closed and accepted risks are hidden unless you switch them on, so a risk somebody closed last month will not appear in the pass. Turn on show closed and accepted to check, or search for it directly — search covers the title, the reference, the category, the owner, the detail and the tags.
Every risk in a category has the same gap
That is a finding rather than a fault, and usually it means one control is missing rather than twelve. Create the control once, then link it from each risk's Controls section. If the shared problem is a missing owner or cadence instead, select the rows together and use the bulk editor, ticking only the fields you want to change.
Habits that keep the gap list short
- Link a control the day you write the risk. The gap is easiest to close in the minute you notice it, and hardest to find six months later.
- Sort on Residual for reporting, on Inherent for gap-hunting. Residual tells you where you stand; inherent tells you what is riding on the controls you are about to look for.
- Keep a saved filter for the intersection. High and Critical, above appetite, checked at the start of every month, takes under a minute once it is named.
- Revisit planned controls on a schedule. They are the largest source of false comfort in any register, and a single status change re-scores every risk relying on them.
- Write Accept down when you mean it. An accepted risk with a rationale is a decision; an untreated risk with an empty treatment field is an oversight, and only one of them survives a question.
- Borrow from the Risk Library. Its thirty-nine worked examples each carry controls to consider, which is a useful starting list when a risk has none and nobody can think of one.
- End the pass with an export. A report including controls and open actions is a dated record of where the gaps were, which makes next quarter's comparison honest.
Frequently asked questions
How do I find risks with no controls?
Open the Risks list, put the Inherent and Residual columns beside each other, and sort by Inherent. Any row where the two numbers are equal has nothing operating to reduce it. Select each one and open the Controls section of the panel to confirm whether the list is empty or everything in it is still planned.
Why is my residual risk score the same as my inherent score?
Because nothing is taking points off it. Either no controls are linked to the risk, or the ones that are linked are planned or retired rather than implemented or operating. Residual can never exceed inherent, so when there is no reduction to apply the two figures sit level. Link an operating control and the residual drops straight away.
Do planned controls reduce a risk score?
No. Only controls that are implemented or operating reduce risk, and RiskOS says so rather than crediting intent. A planned control with high effectiveness changes nothing until its status changes. When you do set it to operating, every risk deriving effectiveness from that control is re-scored at once.
Can a risk have no controls and still be acceptable?
Yes, provided the decision is recorded. Set the treatment strategy to Accept and write the reasoning into the plan. What makes it defensible is the combination of an explicit decision and a residual score that sits inside your risk appetite. An untreated risk above appetite is flagged everywhere it appears, which is the distinction that matters.
How do I find controls that are not linked to any risk?
Open the Controls list and sort by the Risks column, lowest first. Every control showing zero is connected to nothing in the register. That usually means a link was never made rather than that the control is unnecessary, so it is worth working through the list from the risk side and attaching what you already rely on.
What does a lower residual score with no linked controls mean?
It means control effectiveness was set by hand instead of derived from linked controls. The score is real, but nothing in the register supports it. Either link the controls you are relying on so the figure has an argument behind it, or keep the hand-set value and write the evidence into the risk's description so the next reader can follow it.
How often should I check for uncontrolled risks?
A monthly scan of the saved filter for high and critical risks above appetite takes a minute. A full pass through every active risk belongs with the quarterly review, where Review mode walks the register one risk at a time with the linked controls shown beside the scoring inputs. Anything you skip there stays untouched and appears in the next pass.
Can a risk report show which risks have no controls?
Include the controls section and the per-risk detail pages when you build the report, and each risk's linked controls appear alongside its scores. Because inherent and residual are printed together, the rows with nothing reducing them are visible on the page. Every output is built from the same snapshot, so the PDF, HTML and Excel versions always agree.