Triage the risk register

Objectives

The risk register goes to the committee tomorrow with 40 rows. You may flag only the rows where the register misrepresents the organisation's actual exposure.

Raise those rows worst first. Leave the ones that are simply uncomfortable reading.

List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.

R-1  R-03 rated low residual because "a policy exists"; no control is linked and no test has ever run.
R-2  R-07 inherent and residual scores identical; the linked control was retired last year and never unlinked.
R-3  R-11 accepted by the CTO, who is not the risk owner and has no acceptance authority under the framework.
R-4  R-14 description is three sentences long and poorly written.
R-5  R-18 review date passed six weeks ago; owner is on parental leave.
R-6  R-22 uses "medium" where the taxonomy says "moderate".
R-7  R-25 residual rating lowered from high to low with no change in control coverage and no rationale recorded.
R-8  R-30 sorted below R-31 despite a higher score, because the sheet is sorted by id.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the fixture as a population, not a list

   The register's job is to state exposure honestly. Judge each row against that job, not against whether it is well written.

2. Step 2

   Decide what actually qualifies

   Four rows overstate the organisation's control position or record a decision nobody was entitled to make. The other four are stale, ugly or badly sorted: real, but not misrepresentation.

   The right findings are raised

3. Step 3

   Resist the loud lines

   An overdue review and a taxonomy mismatch will both tempt you. Neither changes what the committee believes about exposure; a wrongly lowered residual does.

   Benign lines are left out

4. Step 4

   Grade the exposure, not the wording

   Rank credit-for-nothing highest: a low residual justified by a policy that nothing tests is the register lying about the thing it exists to report.

   An acceptance signed outside authority is a governance defect of a different shape: serious, but the exposure is at least recorded.

   Severity matches the actual exposure

5. Step 5

   Rank so the first line is the one you act on

   Worst first means most misleading first. The committee reads the top of your list and stops.

   Ranked worst first

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.