How to report top risks on Mac
You can do this with RiskOS, a risk register for macOS. Rank by residual score, show the trend, and say what is being done about each.
Most registers are read from the top and no further. A committee that will never open a single risk panel still has to leave the room knowing which risks sit above appetite, which way they have been moving, and who is doing what about each one. That page is the top-risk list, and it is worth only as much as the ordering behind it.
The top risks section is drawn in residual order, worst first. It ranks where you stand once the controls you have recorded are taken into account, not the exposure you started from.
Where the top risks list comes from
Two places in RiskOS show the same ordering. Risks in the sidebar holds the register: a sortable table with Ref, Risk, Owner, Inherent, Residual, Target, Trend, Appetite, Status and Review columns. Click the Residual heading and the register reorders around it. What you are looking at is the list your report will produce.
The report is assembled in Reports, under Output. Cover fields sit at the top, section toggles beneath them, the scope choice after that. Top risks is one of those toggles and it carries a number, anything from 3 to 50. The two views never disagree, because the report comes from a snapshot of the register as it stands when you export.
Report your top risks, step by step
-
Rank the register by residual score
Choose Risks in the sidebar and click the Residual column heading. The worst rows rise to the top, and you are reading the order the report will use. Right-click the table header if Trend and Appetite are hidden; you can show, hide and reorder columns there, and RiskOS remembers the arrangement.
-
Bring stale ratings up to date
A ranking is only as current as the scores in it. Choose Review and pick the Overdue for review scope, which carries a live count. Risks arrive one at a time, worst first, with owner, actions, controls and the last review beside the scoring inputs. Press ⇧⌘↩ to confirm a rating that still holds, or re-score and press ↩ to save and move on.
-
Give every top row an owner and a treatment
Open each risk that will make the cut and check three parts of the panel. Summary holds the owner. Treatment holds the strategy — Mitigate, Accept, Transfer or Avoid — with the plan and a due date. Actions holds the work itself. A top row with no owner and no plan is the question you will be asked in the meeting.
-
Open the report builder
Choose Reports in the sidebar. If you keep a profile per client, check the switcher in the sidebar footer first, or press ⌃⌘P to cycle, because each profile carries its own appetite and report defaults.
-
Fill in the cover fields
Set the report title, the organisation the report is about and prepared by. A top-risk paper is forwarded more often than anything else you produce, so name it for someone reading it out of context: Principal Risks, Q3 tells a reader more than a filename ever will.
-
Switch on top risks and set the number
Turn on the top risks toggle and set how many rows it should carry, between 3 and 50. The number is the depth of the cut, not a selection: the section always takes the worst residual scores in order, so raising it from five to ten adds the next five rows rather than changing the first five.
-
Add the sections that say what is being done
A ranking on its own invites the obvious question. Switch on open actions so outstanding treatment work appears, and controls so the reader sees what the residual scores rest on. Add the executive summary and risk matrix for context, and per-risk detail pages when each top risk deserves one. Then set the scope: closed and accepted risks are included only if you ask.
-
Export and read the list before you send it
Press ⇧⌘P for the PDF, ⇧⌘E for the self-contained HTML file, or ⌘P to print. Choose where it goes — Documents ▸ RiskOS keeps packs together — and accept the suggested name, which carries the date. RiskOS confirms the export with its filename. Then read the section: every row should have a score you recognise, an owner, a direction of travel and a sentence about what happens next.
How the ranking is decided
The order is residual score, highest first. Residual is likelihood multiplied by impact once the effectiveness of your linked controls is taken into account, on the same 1 to 25 scale as the rest of the register. Nothing about it is editorial: you cannot promote a favourite risk up the list, and you do not have to argue anyone down it. Here is a worked example from a register of twelve active risks, average residual 9.6, organisation appetite 9.
| Ref | Risk | Residual | Against appetite |
|---|---|---|---|
| RSK-0007 | Backup restoration has never been tested end to end | 15 | Six over |
| RSK-0001 | Ransomware encrypts primary file shares | 15 | Six over |
| RSK-0011 | Supplier concentration in a single logistics partner | 12 | Three over |
| RSK-0005 | Regulatory reporting deadline missed | 10 | One over |
| RSK-0006 | Unreviewed AI model output reaches customers | 9 | At appetite |
Why residual and not inherent
Inherent score says how bad the world would be with nothing in the way. Residual says where you stand this morning, which is the only question a top-risk list is asked. Ranking on inherent puts your best-defended risks at the top and buries the ones nobody has treated. Residual also keeps the list moving for the right reason: when a control becomes operating, every risk relying on it re-scores and the ranking reorders itself.
What appetite adds to the ranking
Appetite does not change the order, but it draws a line across it. The threshold is the highest residual score you will tolerate, and a risk above it is flagged everywhere it appears. Four of the twelve active risks in the worked register sit above an appetite of 9, and that count is usually the headline a committee wants. A category can carry its own threshold with a rationale, and a risk can override both.
What happens when two risks tie
Ties are common, because only a few scores are reachable on a 5×5 scale. Two risks on 15 are equal on the evidence recorded, and neither should be presented as the worse of the pair. To separate them, use what the register already holds: the gap to target, the trend, the onset velocity and the detectability.
Choosing how deep to cut the list
The number you set between 3 and 50 is really a decision about the reader. A list nobody finishes reports nothing.
| Rows | Suits | Why |
|---|---|---|
| 3–5 | A board with one hour and a full agenda | Fits on a page and in a single conversation |
| 10 | A quarterly risk committee | Shows the shape of the portfolio, still readable in the room |
| 20 | A management team working the portfolio | Reaches below the appetite line into what is coming next |
| 50 | An audit, assurance or year-end pack | Effectively the whole register for most organisations |
When the list is nearly the whole register
With twelve active risks, a top ten is barely a cut, and presenting it as one is misleading. Either take the number down to five so the section does real work, or switch on the full register and call it what it is. A third option is to cut at the appetite line: set the depth so it lands past the last breaching risk — five rows in the worked example — and the section reads as a complete account of your exceptions.
Showing which way each risk is moving
A score on its own is a still photograph. Two risks on 15 sit in very different positions if one has come down from 20 over two quarters and the other has climbed since March, and that difference is what a committee acts on. The Trend column carries the movement, so make sure it is showing before you take the ranking as read. For one risk, History holds a chart of the residual score over time and every assessment with its reason.
Letting the evidence argue with the rating
Two other sections can challenge a rating before a reader does. Indicators are numbers you measure on a cadence, each with a warning and a breach threshold — a restore test success rate of 72 % against a threshold it has breached says something about RSK-0007 that no rating debate will. Events record what actually happened, and when a risk materialises more often than its likelihood implies, RiskOS says so and suggests what the observed frequency would justify.
Saying what is being done about each risk
Every row in a top-risk list carries an implied question. The treatment strategy answers it in one word; the plan, the date and the open actions answer it properly.
| Strategy | What you are telling the reader | What the row should also carry |
|---|---|---|
| Mitigate | You are reducing it, and work is under way | A plan, a due date and at least one open action |
| Accept | You are living with it deliberately | The reasoning, and an appetite position that supports it |
| Transfer | Someone else carries part of the consequence | Who carries it, and what plainly remains with you |
| Avoid | You are removing the activity that creates the exposure | The decision taken, and when it takes effect |
Reading the worked example out loud
Take RSK-0007. Inherent 20, residual 15, because the strongest control operating against it is a set of immutable offsite backups rated Moderate. The quarterly restore rehearsal that would take it further is still Planned, and a planned control, however strong it will be, reduces nothing yet. The target is 4, so there is an eleven-point gap, and the comparison grid in the panel states what strength of control would close it.
Aloud, that is one sentence: we are six over appetite on untested restores, the mitigation is a rehearsal that has not started, and M. Halvorsen owns it. Every part of it is a field the report already prints. Switch on open actions and the ratio behind the list comes too — sixteen open, three overdue, each naming its risk or control.
Troubleshooting
The list is not in the order I expected
Check whether you are reading residual or inherent. The register sorts by whichever column heading you last clicked, and the report section always uses residual. If the two look different on screen, click Residual in the table and compare again.
A risk I think is our worst is not on the list
Its residual score is lower than you believe. Open the risk and look at Controls: if the residual is derived from a linked control, one marked implemented or operating is pulling the score down. Where a hand-set value disagrees with the linked controls, the panel points that out.
The list is shorter than the number I set
There are fewer risks in scope than the depth you asked for. A top-twenty section in a register of twelve active risks lists twelve. Closed and accepted risks are excluded unless the scope switch includes them, which is often the missing rows.
A risk over appetite sits below one that is not
That is correct, and it usually means a category or risk-level override is in play. The ranking is always by score; appetite is a separate threshold, and any category can carry its own with a written rationale. A risk scoring 10 in a category held to a tighter threshold is in breach, while a risk scoring 12 in a category with a wider one is not. RiskOS resolves the threshold in order: the risk's own override first, then the category, then the organisation.
The same risk has topped the list for four quarters
That is a finding rather than a fault, and worth reporting as one. Open History and read the assessments: if the score has not moved and the reasons repeat, the treatment is not working. Look at the due date and the open actions attached to it.
Routines that keep a top-risk list credible
The section takes a minute to switch on. These habits are what make the minute worth anything.
- Review before you report, never after. Clear the overdue reviews first, so the ranking reflects current judgements rather than last year's.
- Lead with the count above appetite. Four of twelve is a sentence an executive can hold; a table of scores is not.
- Keep the depth constant between meetings. A list that is five rows one quarter and fifteen the next cannot be compared, and comparison is most of what a series of reports is for.
- Pair the list with open actions every time. A ranking with no work attached invites the question you should have answered on the page.
- Save the view you keep rebuilding. Save Current Filter… names a combination of band, appetite and status so it comes back in one click.
- Report the movement, not only the position. Show the Trend column and name the risks that have climbed, even when they have not reached the top yet.
- Back up before a reporting cycle. File ▸ Back Up RiskOS… writes everything RiskOS holds to a single file, so the register behind the pack is recoverable as well as reportable.
Frequently asked questions
How do I produce a top risks report on a Mac?
Choose Reports in the sidebar, fill in the report title, organisation and prepared-by fields, switch on the top risks toggle and set how many rows it should carry. Then press ⇧⌘P for a PDF or ⇧⌘E for a self-contained HTML file. The section lists risks in residual order, worst first.
How many risks should a top risks report show?
The section accepts any number from 3 to 50. Five suits a board with a full agenda, ten suits a quarterly risk committee, and twenty suits a management team working the whole portfolio. If a top ten would be nearly your entire register, drop to five or switch on the full register instead.
Are top risks ranked by inherent or residual score?
Residual. That is the score once the effectiveness of your linked controls has been taken into account, which is the position a reader is actually asking about. Ranking on inherent score would put your best-defended risks at the top and hide the ones that have never been treated.
How do I show which risks are over appetite in a report?
Set an organisation appetite in Settings and any risk above it is flagged everywhere it appears, including the report. Categories can carry their own thresholds with a written rationale, and an individual risk can override both. Reporting the count above appetite alongside the ranking is usually the headline a committee wants.
Can I show the trend for each top risk?
Yes. The register table has a Trend column; right-click the table header to show it if it is hidden. For a single risk, the History section of its panel holds a chart of the residual score over time along with every assessment and the reason it was made.
Why is my worst risk missing from the top risks list?
Its residual score is lower than you expect, or it is out of scope. Check the controls linked to it, since one that is implemented or operating pulls the residual down, and check whether the risk is closed or accepted — those appear only when the scope switch asks for them.
What should each top risk row say about treatment?
The strategy in one word — Mitigate, Accept, Transfer or Avoid — with the plan, the due date and the owner behind it. Switch on the open actions section so outstanding work appears too, with overdue items visible. Each action shows the risk or control it belongs to, so nothing floats free of what it is fixing.
Will a top risks report match the register exactly?
Yes, as at the moment you produced it. Every output is built from one snapshot, so a PDF, a printed copy, an HTML file and a workbook exported together always agree. Documents produced weeks apart differ because each records the register as it stood that day.