Committee exception summary
Critical / High Open3
Outside Appetite8
Overdue Actions4
Red KPIs3
Headline metrics
System Availability99.94%
Patch Compliance91%
Critical Vulns >30 Days2
P1 Incidents1
Risk migration: inherent → residual (5×5)
–
estate healthInherent (before controls)
19 risks plotted
Residual (after controls)
19 risks plotted
0 risks
1 risk
2–3 risks
4+ risks
Risk appetite by category
Highest residual score in each category vs its own appetite ceiling. Ceilings differ by category, so a Moderate-rated risk can still breach a tighter one.
At a glance
Where leadership should focus
Risk register · open items
19 open risks across 8 risk categories and 8 divisions. Filter below, or click a risk for full committee detail.
R-18
OUTSIDE APPETITE
Overdue
Multi-factor authentication not enforced for all cloud administrator accounts
Full committee detail
InherentL4 × I5 = 20
Control effectiveness35%
ResidualL4 × I4 = 16
OwnerGroup IT Security Manager
Last review4d ago
Target closure14d
Treatment actionEnforce MFA on all privileged cloud accounts immediately
Committee commentaryEmergency change raised; enforcement rollout in progress this week.
R-19
OUTSIDE APPETITE
Not Started
No tested failback procedure from the DR site to the primary data centre
Full committee detail
InherentL4 × I4 = 16
Control effectiveness40%
ResidualL3 × I4 = 12
OwnerIT Infrastructure Manager
Last review19d ago
Target closure48d
Treatment actionDocument and test the DR-to-primary failback procedure
Committee commentaryIncluded in next DR test cycle scope.
R-02
OUTSIDE APPETITE
Overdue
Legacy VPN concentrator at regional site lacks MFA enforcement
Full committee detail
InherentL4 × I4 = 16
Control effectiveness40%
ResidualL4 × I3 = 12
OwnerRegional IT Lead
Last review20d ago
Target closure30d
Treatment actionReplace legacy VPN with Zero Trust remote access
Committee commentaryProcurement approved; hardware delayed by supplier lead time.
R-08
OUTSIDE APPETITE
Overdue
Core data centre UPS batteries beyond manufacturer end-of-life
Full committee detail
InherentL3 × I4 = 12
Control effectiveness50%
ResidualL3 × I3 = 9
OwnerInfrastructure Manager
Last review10d ago
Target closure20d
Treatment actionReplace UPS battery strings at primary data centre
Committee commentaryParts on order; interim generator test completed successfully.
R-12
In Progress
ERP upgrade project tracking six weeks behind schedule with unresolved data migration risks
Full committee detail
InherentL4 × I4 = 16
Control effectiveness45%
ResidualL3 × I3 = 9
OwnerProgramme Director
Last review7d ago
Target closure70d
Treatment actionRe-baseline project plan and add a data migration dry-run cycle
Committee commentarySteering committee reviewing revised timeline this week.
R-11
OUTSIDE APPETITE
In Progress
Payroll processing outsourced to a provider without a right-to-audit clause
Full committee detail
InherentL3 × I4 = 12
Control effectiveness45%
ResidualL3 × I3 = 9
OwnerDivision Compliance Lead
Last review14d ago
Target closure38d
Treatment actionRenegotiate contract to include right-to-audit and security addendum
Committee commentaryLegal engaged; contract renewal window opens next quarter.
R-06
OUTSIDE APPETITE
Scheduled
Disaster recovery failover for core ERP not tested in live conditions
Full committee detail
InherentL3 × I5 = 15
Control effectiveness55%
ResidualL2 × I4 = 8
OwnerIT Infrastructure Manager
Last review18d ago
Target closure33d
Treatment actionConduct full DR failover test for core ERP
Committee commentaryTest window booked with vendor for next quarter.
R-01
OUTSIDE APPETITE
In Progress
Privileged account access not reviewed quarterly across core financial systems
Full committee detail
InherentL4 × I5 = 20
Control effectiveness70%
ResidualL2 × I3 = 6
OwnerGroup IT Security Manager
Last review12d ago
Target closure45d
Treatment actionImplement quarterly privileged access recertification
Committee commentaryAccess review tooling live; first full recertification cycle scheduled next month.
R-04
OUTSIDE APPETITE
In Progress
Data retention schedule not enforced in legacy document archive
Full committee detail
InherentL3 × I4 = 12
Control effectiveness60%
ResidualL2 × I3 = 6
OwnerData Protection Officer
Last review15d ago
Target closure60d
Treatment actionApply automated retention and deletion rules to archive
Committee commentaryPolicy approved; technical implementation in build.
R-14
In Progress
IT policy suite has not been reviewed against the ISO/IEC 27001:2022 updated control set
Full committee detail
InherentL3 × I3 = 9
Control effectiveness50%
ResidualL2 × I3 = 6
OwnerISMS Manager
Last review11d ago
Target closure55d
Treatment actionComplete gap assessment against ISO 27001:2022 and update policy suite
Committee commentaryGap assessment 60% complete.
R-16
In Progress
Single point of failure: only one engineer certified on the core network switching platform
Full committee detail
InherentL3 × I4 = 12
Control effectiveness50%
ResidualL3 × I2 = 6
OwnerIT Infrastructure Manager
Last review16d ago
Target closure40d
Treatment actionCross-train two additional engineers and document runbooks
Committee commentaryTraining scheduled; runbook documentation 30% complete.
R-17
Overdue
IT support role vacant for four months at regional site, service desk relying on remote cover
Full committee detail
InherentL2 × I3 = 6
Control effectiveness40%
ResidualL2 × I3 = 6
OwnerRegional IT Lead
Last review25d ago
Target closureoverdue by 8d
Treatment actionFinalise recruitment for the regional IT support role
Committee commentaryCandidate shortlisted; offer delayed by budget sign-off, service desk SLA impacted this period.
R-10
In Progress
Cloud hosting provider's SOC 2 report has not been reviewed this financial year
Full committee detail
InherentL2 × I4 = 8
Control effectiveness70%
ResidualL1 × I4 = 4
OwnerVendor Risk Manager
Last review5d ago
Target closure15d
Treatment actionObtain and review current SOC 2 Type II report
Committee commentaryReport requested from vendor; review scheduled on receipt.
R-13
In Progress
Emergency changes bypassing standard change advisory board approval
Full committee detail
InherentL3 × I3 = 9
Control effectiveness60%
ResidualL2 × I2 = 4
OwnerRegional IT Lead
Last review9d ago
Target closure12d
Treatment actionEnforce retrospective CAB review for all emergency changes
Committee commentaryProcess updated; compliance being monitored monthly.
R-07
Not Started
Single points of failure in site network connectivity, no secondary ISP link
Full committee detail
InherentL3 × I3 = 9
Control effectiveness65%
ResidualL2 × I2 = 4
OwnerRegional IT Lead
Last review25d ago
Target closure50d
Treatment actionProvision secondary ISP circuit
Committee commentaryBudget approved for FY27; vendor selection underway.
R-05
In Progress
Customer data shared with a third-party logistics provider without a signed DPA
Full committee detail
InherentL4 × I4 = 16
Control effectiveness80%
ResidualL2 × I2 = 4
OwnerDivision Compliance Lead
Last review6d ago
Target closure10d
Treatment actionExecute data processing agreement with logistics partner
Committee commentaryDPA in legal review, expected signature this month.
R-03
On Track
Endpoint detection and response not deployed on 15% of laptops
Full committee detail
InherentL3 × I4 = 12
Control effectiveness75%
ResidualL2 × I2 = 4
OwnerEndpoint Security Lead
Last review8d ago
Target closure25d
Treatment actionComplete EDR rollout to remaining laptop fleet
Committee commentaryRollout 85% complete, on schedule.
R-09
Not Started
Site server room cooling redundancy below design spec
Full committee detail
InherentL2 × I3 = 6
Control effectiveness70%
ResidualL1 × I3 = 3
OwnerSite IT Coordinator
Last review30d ago
Target closure60d
Treatment actionInstall secondary cooling unit
Committee commentaryLow priority; monitored monthly, no incidents to date.
R-15
Not Started
No formal IT asset disposal record for decommissioned hardware at two sites
Full committee detail
InherentL2 × I3 = 6
Control effectiveness65%
ResidualL1 × I2 = 2
OwnerShared Services Manager
Last review22d ago
Target closure30d
Treatment actionImplement certified asset disposal process with disposal certificates
Committee commentaryVendor identified; process rollout planned for next cycle.