One risk record, three distinct judgments
The register asks the group to say what could happen before controls, what the controls actually show, and what residual judgment follows from the discussion. It leaves room for uncertainty instead of hiding it in a score.
Keep inherent, control, and residual separate
Inherent
What could happen and why, before considering the control response? Record likelihood, impact, and the conditions behind both.
Control
What does the control do? Keep its design and its operation separate, then name the evidence available for the period.
Residual
After the discussion, what is the remaining likelihood and impact? Write the rationale; do not derive it from a control rating.
A late correction at close
Risk statement
“Month-end close misses the agreed reporting date after a late source-file correction.”
Before controls
- Likelihood
- Likely
- Impact
- Significant
Two recent closes had late adjustments, the deadline is fixed, and a reviewer is shared across reports.
Control evidence
- Design
- Specific
- Operation
- Partly evidenced
Close calendar, named cut-offs, late-adjustment log, and reviewer reconciliation. Prior-cycle execution was inconsistent.
After discussion
- Likelihood
- Possible
- Impact
- Significant
The process should surface late adjustments, but a deputy reviewer is not yet trained. The group retains a “Likely” dissent until that evidence exists.
Try the decision record
Use the same close scenario and change the inputs below. The check points out missing judgments.
- Frame the objective and risk statement.
- Record inherent judgment before discussing the control.
- Discuss design, operation, and evidence separately.
- Record residual judgment, dissent, owner, and dates.
Change an input to check the record.
Define what each rating word means
Likelihood
Rare · Unlikely · Possible · Likely · Almost certain
A comparison of how credibly the event could occur in the stated horizon. “Not assessed” means no conclusion.
Impact
Limited · Moderate · Significant · Severe · Critical
A comparison of consequence if the event occurs. Define impact in terms the decision-makers recognize.
Set up the same model in Workiva
Once risk language, ownership, and review rhythm are settled, Lockfield can help scope a Workiva Enterprise Risk Management configuration around your organization’s fields, roles, requests, remediation, and evidence needs.
Official Workiva context
Workiva’s overview covers its enterprise risk management capabilities.