How to use the risk dashboard on Mac
Do it in RiskOS, a risk register for macOS. Fourteen cards in a fixed order, and three of them that earn a minute every morning.
Most mornings you do not need the whole register. You need four facts: what is above appetite, what is late, which way things are moving, and whether anything happened that your ratings did not expect. The dashboard in RiskOS answers all four in one scroll. It rewards a fixed reading order far more than a browse.
Every figure on this screen is worked out from the register as it stands. Nothing on the dashboard is entered separately or kept up by hand, so a rating you change in a risk panel is already counted the next time you look.
Where the dashboard lives
Choose Dashboard in the sidebar. It sits directly under Profiles and above the Register group, the first section in the window that is about your data rather than about which organisation you are working for.
What opens is a single scrolling column. A header line runs across the top, and under it come fourteen cards in a fixed order: a row of six counters, then the matrix and the category breakdown, then the cards that count what needs doing. The order never changes and there is nothing to arrange, so after a week you will be scrolling to a card by memory.
A quiet reminder also appears when a backup is getting old, and it is worth clearing on the spot rather than leaving for later. Choose File ▸ Back Up RiskOS… and the whole register is written to a single file wherever you choose to put it.
Read the dashboard in order
-
Open the dashboard
Choose Dashboard in the sidebar. Before you read a single number, glance at the profile switcher in the sidebar footer and confirm which profile you are in. A profile carries its own methodology and its own appetite, and the appetite decides whether a risk counts as a breach.
-
Read the header line first
The heading says Risk posture, and the line beneath it is the register in one sentence: how many active risks exceed appetite, out of how many, and which way the register is trending. On the right sits the average residual score out of 25.
In the worked register that reads four of twelve active risks exceeding appetite, trending down, with an average residual of 9.6. The sentence should be dull most days. When it changes, something real has happened.
-
Take the six counters as a group
Critical, High, Medium and Low count the active register by band. Over Appetite and Review Overdue count the two failures that matter most. Read them across rather than one at a time: zero Critical with four Over Appetite is an appetite doing its job, while four Critical and nothing over appetite usually means the threshold is set too generously.
-
Work the Needs Attention card
Scroll to Needs Attention. It carries three lines and nothing else: risks above appetite, risks overdue for review, and risks with overdue actions. In the worked register that is four, three and three. They are the only lines on the dashboard that describe an obligation rather than a measurement, which is why they come first.
-
Read the Indicators card
Find Indicators. The card opens with how many need attention, then lists the worst of them with the latest reading and the direction it moved. In the worked register four want a look: Critical patches outstanding beyond SLA at 14 and Backup restore test success rate at 72 % are both in breach, while Vendor assurance reviews overdue at 3 and Days to detect a security event at 3 days sit in warning.
Indicators move between reviews, which is the point of them. A breach here is an argument for re-scoring a risk before its cadence falls due.
-
Clear what is in Overdue Actions
At the foot of the column, Overdue Actions shows one card per late action with its due date and the risk or control it belongs to. Open Actions in the sidebar for the full list, where every row edits in place: change a status, move a date, tick a checkbox to complete one and strike it through. Clearing three late actions before the day starts is worth more than reading every card closely.
-
Use the matrix to see the shape of the register
The Residual Risk Matrix is the 5×5 grid with a count in every cell that holds risks. Read it for shape rather than detail: a diagonal band through the middle is a healthy register, a cluster in the top-right corner is a backlog. When a corner looks wrong, open Risks and set the band filter to bring up the rows behind it.
-
Start a review when reviews are late
If Review Overdue is not zero, choose Review in the sidebar and pick the Overdue for review scope, which carries a live count of what it holds. Risks then arrive one at a time, worst first, with a progress bar and the full context beside the scoring inputs. Confirming or re-scoring stamps the review date and schedules the next one from the risk's cadence.
The header, and the six counters under it
The header is the only part of the dashboard meant to be read at a distance. The average residual on the right is the mean of every active risk's residual score, out of 25, and it is the fastest honest measure of whether a quarter of treatment work landed. It moves slowly, which is a feature: an average that swings every week is a register being re-scored on mood.
The counters under it use the same four bands as the rest of RiskOS, plus the two counts that describe breach. Each band pairs its colour with a symbol and the written word, so the row reads the same to someone who cannot separate the two warm colours.
| Counter | What it counts | How to read it |
|---|---|---|
| Critical | Active risks with a residual score of 17–25 | Escalation. Anything above zero belongs in the next management meeting. |
| High | Residual 10–16 | The working queue. Each one wants a named owner, a plan and a date. |
| Medium | Residual 5–9 | Treat where it is cheap to do so, and watch for movement. |
| Low | Residual 1–4 | Accept and review at the cadence you set. |
| Over Appetite | Active risks whose residual sits above the threshold that applies to them | The count your appetite exists to produce. Follow it into Exceeding Appetite. |
| Review Overdue | Active risks whose next review date has passed | The register ageing. Clear it in one review pass. |
The fourteen cards, in the order they appear
Each card answers one question. Knowing which question belongs to which card is most of the skill of reading the screen quickly, because it tells you what to skip on a quiet morning.
| Card | What it shows | The question it answers |
|---|---|---|
| Severity counters | The four bands across the active register, with Over Appetite and Review Overdue beside them | How much of the register is in breach? |
| Residual Risk Matrix | The 5×5 grid, with a count in every cell that holds risks | Where does the register cluster? |
| By Category | How many risks sit in each category, longest bar first | Which part of the organisation is carrying the exposure? |
| Events | Risks that actually happened in the last year, how many are still open, and a warning when one recurs more often than its rating implies | Does the register match reality? |
| Treatment Progress | Risks that have reached their target, with open actions, overdue actions and the number still above target | Is treatment moving? |
| Control Posture | Controls counted as planned, implemented and operating, plus risks with no control linked | Is anything defended only on paper? |
| Trend | Risks rising, level and falling, and how many have too little history to show a direction | Which way is the register going? |
| Onset Velocity | The register split by how quickly each risk would arrive: immediate, rapid, moderate, slow | How much warning would you get? |
| Indicators | Indicators needing attention, worst first, with their latest readings and direction | What is moving before anyone re-scores? |
| Framework Coverage | One bar per framework: requirements covered out of the total | How far do the controls actually reach? |
| Needs Attention | Risks above appetite, overdue for review, and carrying overdue actions | What is wrong right now? |
| Top Risks | The highest residual scores, worst first, with owner, reference and trend | What would you name in a meeting? |
| Exceeding Appetite | One card per risk above its threshold, with how far over it sits | Which breaches, and by how much? |
| Overdue Actions | One card per late action, with its due date and what it belongs to | What is late, and whose is it? |
The cards that reward a slower look
Three of the fourteen suit a weekly reading rather than a daily one. Control Posture counts controls as planned, implemented and operating, and names how many active risks have no control linked at all: a register full of planned controls is a plan, not a defence. Treatment Progress counts risks that have actually reached their target, alongside open and overdue actions. Onset Velocity never changes a score; it tells you how much warning you would get, which is what separates two risks that share a number.
The three cards to read first
If you give the dashboard sixty seconds a day, spend them here. Everything else on the screen is measurement. These three are obligations.
Needs Attention, first
Three lines, three duties. Risks above appetite are exposures the organisation has already said it will not carry. Risks overdue for review are ratings nobody has stood behind recently. Risks with overdue actions are promises that have slipped. None of the three is a judgement call.
Indicators, second
An indicator is a number you measure on a cadence, with a warning threshold and a breach threshold, and it moves in between reviews. That makes this the one card that can tell you something has changed before anybody has changed a rating. A breach is a prompt to open the risks that indicator watches and ask whether the likelihood still holds.
Overdue Actions, third
The last card closes the loop. A register with a good matrix, a clean appetite and a pile of late actions is a document, not a programme. Open Actions, work the overdue group at the top of the list, and let the count fall to nothing. Every row there carries the risk or control it belongs to, so nothing needs hunting down first.
Following a number back to the register
The dashboard is not a place you read and leave. Every card summarises rows that live in a section of their own, and the habit worth building is going to those rows rather than describing a card from memory.
Filter the register by band
A cluster in the matrix is a question the register answers in seconds. Open Risks and set the band filter to Critical or High, and the table lists exactly the rows sitting in that corner, ready to sort, edit or select in bulk. The over-appetite only filter does the same job for the breach counter. The filter icon fills while any filter is on, so you can see at a glance that you are looking at part of the register rather than all of it.
When a combination earns its keep, Save Current Filter… names it so the same view comes back next week without rebuilding it. A saved filter for the band you treat most often turns a weekly pass into two clicks.
Open the section behind a card
Indicators, Top Risks, Exceeding Appetite and Overdue Actions all summarise rows held elsewhere: Indicators, Risks and Actions. Open the matching section from the sidebar and you have search, the filters and the panel on the right, so a card that raised a question can be answered in full and the answer written down where it belongs.
Read Exceeding Appetite as a queue
Each card names the risk, its reference and owner, and how far over the threshold it sits — 6 over the appetite of 9 for RSK-0007. Sorted worst first, the row is a treatment queue in priority order: open the top card, check the treatment plan and its actions are real, and move down.
Troubleshooting
The dashboard and the register show different totals
The dashboard counts active risks. The register may not be showing the same set: a filter can be on, including one you saved and restored, and the show-closed-and-accepted toggle changes what the table lists. The filter icon fills when a filter is applied, so clear it and the two agree again.
Nothing appears in Exceeding Appetite
Almost always because no threshold has been set. Appetite resolves in a fixed order — a risk's own override, then its category, then the organisation-wide figure — and with none of them set, nothing can be above appetite. Open Settings ▸ Appetite and set the organisation threshold.
Treatment Progress says none of my risks have reached target
That card counts risks whose residual score has come down to its target or below, and a residual only falls when a linked control is implemented or operating. A control still marked planned reduces nothing yet, however strong it will be, and RiskOS says so on the risk itself. Open Controls, set the status of the ones genuinely running, and every risk deriving from them re-scores.
An indicator shows as no data rather than in tolerance
No data and in tolerance are deliberately different states. An indicator with no readings has never been measured, so it cannot be inside a threshold. Open Indicators, record a reading with its value, date and a short note, and the status, the trend and the dashboard count all follow from it.
The backup reminder keeps coming back
It comes back until a backup is made. Choose File ▸ Back Up RiskOS… or press ⇧⌘B, and RiskOS writes the whole register, its history and its settings to one file, saved wherever you choose. How often the reminder appears is yours to set: never, weekly, fortnightly or monthly.
A routine that keeps the dashboard worth reading
The screen stays useful only if the register behind it is kept honest, and a short repeated routine does that better than an occasional deep clean.
- Read it in the same order every day. Header line, counters, Needs Attention, Indicators, Overdue Actions. Five stops, about a minute.
- Treat Over Appetite as the headline. Everything above the threshold is either being treated or being tolerated, and the register should say which.
- Clear Review Overdue in a single pass. Choose Review in the sidebar, take the overdue scope and work the queue worst first, rather than reopening risks individually through the week. Skipping one leaves it completely untouched, so it comes round again in the next pass.
- Let the indicators argue with the ratings. When an indicator is in breach and the risk it watches has not moved in months, one of the two is wrong, and it is rarely the indicator.
- Check Control Posture weekly. Planned controls that never start operating are the commonest reason a residual score sits still for a quarter.
- Take the dashboard into the meeting. The same figures export as an executive summary, a matrix and a top-risks table, so what you read in the morning is what the room sees in the afternoon.
Frequently asked questions
What does the RiskOS dashboard show?
Your whole risk posture on one scrolling screen: a header line with the average residual score, then fourteen cards. They cover the severity counters, the matrix, categories, events, treatment progress, controls, trend, onset velocity, indicators, framework coverage, what needs attention, top risks, appetite breaches and late actions.
How do I see which risks are behind a number on the dashboard?
Open the section the card summarises. For a matrix cluster or a severity counter, choose Risks and set the band filter; for a breach, switch on the over-appetite only filter. Indicators, Top Risks, Exceeding Appetite and Overdue Actions map to Indicators, Risks and Actions in the sidebar, where search, filters and the panel on the right give you the full rows.
What does average residual of 25 mean?
It is the mean residual score across your active risks, shown against the top of the scale. Residual scores run from 1 to 25, so an average of 9.6 sits in the middle of the Medium band. The figure is most useful over months: if a quarter of treatment work has landed, the average should have come down.
Why does the dashboard say a risk materialised more often than its rating implies?
Because the events you logged disagree with the likelihood you set. When a risk has happened more often than its rating would predict, the Events card says so and suggests what the observed frequency would justify. It needs at least two events across a full year before offering an opinion, and the rating stays yours.
What should I check on the risk dashboard every morning?
Three cards. Needs Attention lists risks above appetite, risks overdue for review and risks with overdue actions. Indicators shows what has moved since the last review. Overdue Actions shows work that has slipped its date. Those three describe obligations rather than measurements, and clearing them keeps every other number on the screen trustworthy.
Why is my framework coverage lower than I expected?
Coverage counts a requirement as covered only when a control mapped to it is implemented or operating. A requirement with a mapped control that is still planned reads as mapped but not operating, and an unmapped one reads as not mapped. The three states are kept separate deliberately, so the bar shows real coverage rather than intent.
Can I share what the dashboard shows with someone who does not use RiskOS?
Yes. Open Reports, switch on the executive summary, the risk matrix and top risks, then export. The HTML output is one self-contained file that opens in any browser with nothing fetched from the internet; the PDF carries the same figures with your branding on the cover. Both come from a single snapshot, so they agree.
Does anything on my dashboard leave my Mac?
No. Everything here happens on your Mac. There is no account, nothing is uploaded, and your register never leaves the machine. The counts are worked out locally each time you open the screen, and they go elsewhere only when you export or back up the register yourself.