Skip to content

Risk Register & Residual Risk

Path: /risk-register

The risk register tracks organizational risks and computes control-informed residual risk: instead of a static "inherent 20 → residual 12 because we said so," the residual score is derived from whether the mapped controls are actually passing in your latest completed assessments.

Risk ↔ control mapping

Each register entry can be linked to the controls that mitigate it:

GET    /api/v1/orgs/{org_id}/risks/register/{entry_id}/controls               # list mappings
POST   /api/v1/orgs/{org_id}/risks/register/{entry_id}/controls               # link a control
DELETE /api/v1/orgs/{org_id}/risks/register/{entry_id}/controls/{mapping_id}  # unlink

Linking the same control twice returns 409. Mappings are org-scoped through the register entry.

How residual risk is computed

For each mapped control, the engine takes the latest COMPLETED assessment of that control's framework (org-scoped) and computes:

pass_rate            = passes / (passes + fails)        # N/A and manual-review are not verdicts
effectiveness        = 1 − Π (1 − weight × pass_rate)   # multiplicative across mapped controls
dynamic_residual     = inherent_score × (1 − effectiveness)

Honesty rules baked into the math:

  • A control that has never been tested earns no credit — unmapped or untested risks keep their static residual, they don't magically improve.
  • A failing control contributes zero effectiveness.
  • Verdicts from another organization are never used (cross-org isolation).

The computed dynamic_residual_score, control_effectiveness_score, the calculation timestamp, and the per-mapping cached verdicts are persisted.

Manual override wins

Risk owners can set an explicit residual override:

GET  /api/v1/orgs/{org_id}/risks/register/{entry_id}/residual        # resolved residual + source
POST /api/v1/orgs/{org_id}/risks/register/{entry_id}/recalculate     # recompute dynamic residual
PUT  /api/v1/orgs/{org_id}/risks/register/{entry_id}/residual-override  # set / clear override

Resolution order is always override > dynamic > static, and the response reports which source produced the number — the UI shows a source badge so an override is never mistaken for a computed score.

Using the page

  1. Create register entries with inherent likelihood/impact scores.
  2. Link controls that mitigate each risk.
  3. Click Recalculate to pull current assessment verdicts into the residual score.
  4. Where judgment differs from the computation, set an override — it wins, and it's labelled.

For financial quantification of individual scenarios (ALE, VaR, loss-exceedance curves), see Risk Quantification — completed FAIR simulations also feed the top-risks section of the board pack report.