A register that calculates residual risk from control effectiveness instead of guessing it twice — inherent → controls → residual, with an auto-populated dashboard.
Most registers score residual risk by gut, in the same breath as inherent. This one derives residual from the effectiveness of your controls, so the number moves when your control posture changes — and you can defend it.
Every number is a formula over your inputs — not a workshop opinion. Change an input and the ratings move. That's what makes the output defensible.
One row per risk: 1–5 likelihood and four impact dimensions with written definitions; composite, rating, inherent and residual all calculate.
The calibrated likelihood, impact, and rating-band scales your whole team scores against.
Auto 5×5 residual heat map, counts by rating, top risks by residual, breakdown by category.
How the register supports NIST CSF 2.0, SOC 2, ISO 27001, CIS, and PCI.
Every column heading defined, with a Source column — adapt the language to your org.
A five-step walkthrough and worked examples you delete before use.
Every rating is a transparent formula over your inputs, so it holds up when someone asks "why is this rated this way?"
Ratings trace back to the inputs that produced them — the audit story is built in, not reconstructed after the fact.
A built-in Compliance Mapping tab cross-walks the register to NIST CSF 2.0, SOC 2, ISO 27001, CIS, and PCI.
The thinking: How to Build a Risk Register That Calculates Residual Risk and The Data-Driven Risk Assessment.
A single Microsoft Excel workbook (.xlsx). It recalculates on open — no macros, no add-ins, no subscription. Also opens in Google Sheets and LibreOffice.
No. You fill the shaded input cells; the white cells calculate. Dropdowns prevent bad entries, the Start Here tab walks you through it, and it ships with worked examples you delete before use.
Yes — internally or in client engagements. You can't resell the template itself as a template.
If you need it adapted to a specific framework, org size, or regulator, get in touch — customization and advisory are available.
A register that calculates the number instead of asking the room to estimate it twice.