Building your first risk register: a 90-day implementation guide

Building a register starts with identifying what should be on it. Most organizations underestimate this step, treating it as a single workshop where leadership lists the risks they're worried about. That produces a register reflecting current concerns, not the organization's actual exposure landscape.

Five identification sources

Plan to spend three to four weeks on identification. The output is a raw risk list, often far longer than the final register, with each entry attributed to its source and described specifically enough to be scored.

1. 1Leadership workshops — facilitated sessions with executive leadership generating risks they consider material. Produces the "top of mind" risks; biases toward recently visible categories.
2. 2Functional reviews — separate sessions with each major function (clinical, operational, financial, IT, regulatory, workforce) producing risks specific to their domain. Produces the "specific operational" risks; reduces leadership-workshop bias.
3. 3Historical event review — examination of past incidents, regulatory findings, near-misses, and external peer-organization events for risks that have materialized or nearly materialized. Produces the "already learned" risks the organization should not still be carrying as unidentified.
4. 4External scan — review of regulatory landscape changes, industry threat intelligence, peer-organization disclosures, and accreditor focus areas for emerging risks the organization may not yet have seen surface internally.
5. 5Assessments you already have — the HIPAA security risk analysis, the emergency preparedness hazard vulnerability analysis, recent FMEAs, insurance and claims reviews, and internal audit findings. Each has already identified risks that belong on the enterprise register.

Consolidation and refinement

The raw list always contains overlap, duplication, and entries that are too general to be scoreable. Consolidation reduces the list to a register-ready set, usually a few dozen entries for a first cycle. The consolidation work is judgmental but should follow rules: combine risks describing the same exposure under different framings; split entries that bundle multiple distinct risks; rewrite vague entries as specific potential events.

Resist the urge to over-consolidate. A very short register is suspicious; either the identification was incomplete or distinct risks were merged in ways that lose mitigation specificity.

Scoring calibration

Before scoring the register, calibrate the scoring approach with a small cross-functional group — ideally 4 to 6 people including the CRO, a clinical leader, an operational leader, and a financial leader. Score 5–8 representative risks together, discuss the rationale, and surface where individuals would have scored differently and why. The calibration session is the foundation for consistent scoring across the rest of the register.

Document the scoring rubric that emerges from calibration. Impact and likelihood scales should have explicit anchor descriptions — what does "Impact 4" actually mean for this organization? Without anchored definitions, individual scorers default to their own interpretations and the register loses comparability.

Inherent risk scoring

• Score in pairs or small groups, not individually. Two-person scoring produces conversation that surfaces assumptions; individual scoring produces personal interpretations that vary across the register.
• Document the scoring rationale alongside the score. "Inherent score 16: Impact 4 (significant patient safety consequence with regulatory exposure), Likelihood 4 (occurs in peer organizations 1–2 times per year)." The rationale is what makes the score defensible and revisitable.
• Don't anchor on the residual you can imagine. The inherent score is the exposure with no mitigation. Mentally subtracting the mitigation you already know you have biases the inherent score toward residual.

Ownership assignment

Every entry needs a named executive owner before the register is operational. Ownership should follow the principle that the person whose role gives them line-of-sight to the risk and authority to influence its trajectory carries it.

Avoid two failure modes. First, assigning ownership to whoever attended the identification session. Attendance is not accountability. Second, assigning ownership to a department or committee — "Quality Department" or "the IT Steering Committee." Distributed ownership is no ownership; pin a name.

Confirm ownership with each named owner explicitly. "You are now the Risk Owner for [risk]. This means you are accountable for its trajectory, you'll be the one we contact when it's due for review, and you'll be the sponsor for any RMI launched against it." Ownership accepted in conversation is more durable than ownership assigned in a spreadsheet.

First Risk Committee meeting

Schedule the first Risk Committee meeting at approximately Day 75. The agenda for this meeting is different from steady-state meetings — its job is to ratify the register, confirm risk appetite, and authorize the first set of RMIs.

• Walk through the register at category level, not risk-by-risk. The committee's job at this meeting is to confirm the register is reasonably complete and the scoring is reasonably calibrated, not to debate every score.
• Confirm or revise the initial risk appetite statement. The CRO should bring a draft based on the register's score distribution; the committee approves a working version that can be refined over the first cycle.
• Identify the first 3–5 risks for active mitigation. These should be the highest-exposure risks where mitigation is feasible. Authorizing RMIs for the entire register at once is a setup for diluted attention; concentrated initial mitigation is the right pattern.
• Set the steady-state cadence. Risk Committee monthly, board reporting quarterly, register full review annually. Confirm at this meeting so the rhythm starts immediately.

Launching the first RMIs

For each authorized RMI, the first 30 days after Risk Committee approval are spent in design — naming the sponsor and lead, defining the residual-risk target, designing the KRI, and establishing the monitoring cadence. Launching all authorized RMIs in parallel is fine if the sponsors are different; if the same sponsor is being asked to own multiple RMIs simultaneously, stagger them.

Expect the first KRI data point roughly two months after the committee authorizes an RMI, so around Day 135 if the committee met at Day 75. This is the moment the program transitions from build mode to operate mode — the first evidence that mitigation is or isn't working.

What you'll discover

• Some risks were misscored. Initial scoring is always imperfect; expect to revise scores during the first cycle as the committee and owners develop calibration. This is normal and not a sign of program failure.
• Some risks don't have viable KRIs. A risk that can't be operationalized into a measurable indicator either needs a different mitigation approach (acceptance, transfer) or needs the data infrastructure to be built before mitigation can begin. Surfacing this early is valuable.
• Some owners weren't the right fit. Confirmed ownership occasionally turns out to be wrong — the named owner doesn't actually have the authority or capacity the role requires. Reassign rather than working around it.
• Risks were missed. Despite a structured identification process, the first year of operation will surface risks that should have been on the original register. Add them as they're identified rather than waiting for the annual review.