Risk register
Inherent and residual scoring, treatment decisions, and who accepted what.
Inherent risk distribution
| Impact → | |||||
|---|---|---|---|---|---|
| Likelihood ↓ | 1 | 2 | 3 | 4 | 5 |
| 5 | 2 | ||||
| 4 | 1 | ||||
| 3 | 1 | 1 | 1 | ||
| 2 | 1 | 1 | |||
| 1 | |||||
Cell values are counts of risks at that likelihood/impact pair. Shading is score bands: 1–7, 8–14, 15–25.
Register health
| Total risks | 8 |
| Without an owner | 0 |
| Treatment undecided | 0 |
| No linked control | 3 |
| Review overdue | 0 |
| Accepted without a named acceptor | 0 |
| Ref | Risk | Category | Owner | Inh. | Res. | Treatment | Status | Review |
|---|---|---|---|---|---|---|---|---|
| R-002 | Personal accounts hold company assets | legal regulatory | R. Brunner | 20 | 8 | mitigate | open | 2026-08-19 |
| R-003 | No DPA with any processor | legal regulatory | R. Brunner | 20 | 6 | mitigate | open | 2026-08-19 |
| R-001 | Single founder holds every credential | people | R. Brunner | 15 | 10 | mitigate | open | 2026-08-26 |
| R-005 | Public reputation damage from Safe Browsing flag no controls | operational | R. Brunner | 12 | 6 | mitigate | open | 2026-08-15 |
| R-006 | Secret exposure through chat interface no controls | information security | R. Brunner | 12 | 6 | mitigate | treated | 2026-09-11 |
| R-007 | Hyperdrive caching would replicate personal data globally | legal regulatory | R. Brunner | 10 | 5 | mitigate | treated | 2026-11-10 |
| R-008 | Ambiguous test signal read as a definite result no controls | operational | R. Brunner | 9 | 6 | mitigate | open | 2026-09-02 |
| R-004 | AI agent output accepted without human review | ict | T. Oduya | 8 | 4 | mitigate | treated | 2026-10-11 |