Enterprise risk management in Workiva: building a risk register your team will maintain

At its core, enterprise risk management needs a register that people trust and maintain. In Workiva, that register is a set of structured risk records, each with:

• A clear risk statement: the event, its cause, and its consequence.
• A category from a shared taxonomy, such as strategic, operational, financial, compliance, or technology.
• A named owner accountable for the assessment and response.
• Assessments of likelihood and impact, often both inherent and residual.
• Responses: accept, mitigate, transfer, or avoid, with actions, owners, and dates.
• Links to related controls, audit findings, or key risk indicators (KRIs) where they exist.

Most organizations base the taxonomy and scales on COSO ERM or ISO 31000. Configure Workiva to match the framework you already use.

Write risk statements that can be assessed. “Cybersecurity” is a topic. “A ransomware attack disrupts core systems for more than a week, delaying customer billing and close” can be assessed, owned, and mitigated.

Define scales people read the same way. A 1-to-5 likelihood scale means nothing unless each level has a description, and impact levels need thresholds in terms the business uses: financial amounts, days of disruption, regulatory consequence. Without them, heat maps compare opinions rather than risks.

One owner per risk. Shared ownership becomes no ownership at reassessment time.

Keep the register a manageable size. A focused set of enterprise risks that leadership actually discusses is more useful than a long list nobody reviews. Link detailed operational risks underneath if you need them.

Connect responses to real work. A mitigation that only says “monitor” leaves nothing to track. Actions should have an owner, a due date, and a way to tell whether they are done.

The risk assessment workbook lays out these fields, scales, and a worked example you can adapt.

Here is a fictional risk record. Its scores illustrate one organization’s criteria; they are not Workiva defaults or a prescribed ERM methodology.

In this example, management has agreed that a residual score of 6 or above requires escalation. The risk therefore goes to management with a response owner and deadline; it is not shown as acceptable simply because mitigation is planned. Your own appetite thresholds and approval authority should be agreed before configuring reports.

At reassessment, the owner records what changed, the supporting evidence, the revised assessment, and any remaining action. A successful recovery test may support a different impact rating, but the reviewer still checks it against the defined scale. Keep the prior assessment so a board report can explain movement rather than show only the latest color on a heat map.

The risk assessment workbook provides fields and worked material to adapt. For help translating the agreed methodology into configuration, permissions, and a tested assessment cycle, see Workiva GRC implementation and consulting.

A typical cycle: the ERM lead opens the assessment period, owners update their risks and response status, the ERM lead reviews for consistency, and management reviews the top risks before board reporting. In Workiva, owners receive their assessments as tasks, and progress is visible without email chasing.

Two things keep the cycle honest. First, ask owners what changed and why, not just for new scores. Second, keep prior assessments so the board can see movement over time.

The board usually wants the top risks, how they moved since last time, whether residual risk is within appetite, and the status of key responses. A report connected to the register reduces rekeying, but it still needs a confirmed assessment period, refreshed data, reviewed changes, and approval before release. When it is rebuilt in slides each quarter, the slides and the register can drift apart. Linking register data into a Workiva document or presentation helps keep the report aligned with the reviewed assessment.

ERM is more useful when it is not isolated. Linking enterprise risks to SOX controls and internal audit findings shows where a risk is covered by tested controls and where it is not, and helps internal audit build a risk-based plan. See how internal audit runs in Workiva and how Workiva Controls Management supports SOX.

Treat migration as a cleanup: rewrite vague statements, merge duplicates, confirm owners, and agree on scales before loading anything. The GRC migration planner helps sequence that work.