Risk Register Review¶
Document — instantiates Completeness Audit
Uses a risk register to reveal unlisted hazards, uncovered mitigations, ignored scenarios, or risk categories without owners.
A Risk Register Review works off an existing standing document — the risk register — treating its rows as a coverage map that links each identified hazard to its controls and its owner, then reviewing that map to expose three shapes of incompleteness: hazards that appear nowhere in the register, mitigations listed against no real hazard, and risk rows carrying no accountable owner. Its defining idea, distinct from the one-shot audits among its siblings, is that it binds completeness to live ownership and a recurring cadence: a hazard is not "covered" until a named, currently-staffed owner holds a current mitigation, and the register is re-reviewed on a schedule because the hazard landscape drifts underneath it.
Example¶
During a scheduled quarterly review, the safety team at a chemical plant pulls the risk register and cross-checks it against the plant's process units and a fresh hazard study.[n1] Three failures surface. A newly commissioned heat-exchanger loop has no entry at all — an unlisted hazard the register silently omits. A mitigation labelled "relief-valve inspection" is still listed, but the engineering role that owned it was dissolved in a reorganization — a control now uncovered by any accountable person. And a high-consequence scenario (simultaneous power loss and cooling failure) sits in the register marked "review pending" for three cycles running — a stale row that ownership never closed. Each finding is assigned a named owner and a due date, and the register's next review is set to trigger on both the calendar and any management-of-change event. The review did not re-derive the whole hazard universe; it kept a living document honest by checking coverage, ownership, and freshness.
How it works¶
The mechanism reads the register as the standing hazard-to-control-to-owner map and scans it for gaps of three kinds: rows that should exist and do not (hazards absent), controls that map back to no live hazard (orphan mitigations), and rows whose owner is missing, vacated, or expired. What distinguishes it from a fresh enumeration is that it audits and maintains a persistent artifact: every gap is bound to a currently-staffed owner, and the review itself is scheduled to recur and to re-fire on change, so the register cannot quietly rot between audits.
Tuning parameters¶
- Register granularity — one row per hazard versus per hazard-scenario-control triad. Finer rows map ownership precisely but bloat upkeep.
- Owner-binding strictness — whether a row may exist without a named, currently-staffed owner, or is blocked until one is assigned.
- Cadence and triggers — the calendar interval plus which change events (new equipment, an incident, a reorganization) force an off-cycle review.
- Cross-check source — what external reference (a hazard study, the incident log, a peer site) the register is compared against to reveal unlisted hazards.
- Escalation threshold — which ownerless or stale rows block operations versus receive a grace period.
When it helps, and when it misleads¶
Its strength is keeping a coverage artifact honest over time: by tying every risk to a live owner and forcing periodic re-review, it catches the drift that turns a once-good register into stale reassurance. Its failure mode is that the register can only be as complete as its last cross-check — a hazard nobody has ever named still will not appear — and a fully-owned, all-green register can give false assurance while its rows are the wrong rows. The classic misuse is "risk-register theater": every row has an owner and a green status, yet the register was never compared against the real process, so it certifies a coverage it does not have. The guarding discipline is to drive each review from an external hazard source rather than re-reading the register against itself, and to treat ownership and cadence as necessary but never sufficient for completeness.
How it implements the components¶
coverage_map— the register's rows are the standing map from hazards to their controls and owners; the review reads unlisted hazards and orphan mitigations directly off the gaps in that map.accountable_gap_owner— every hazard row, and every newly found gap, must carry a named, currently-staffed owner responsible for its mitigation and its follow-through.audit_cadence— the review recurs on a calendar interval and re-fires on change events, so completeness evidence does not silently go stale as the plant changes.
It does not decide the substantive disposition of a newly found hazard — whether to amend, accept, or exclude it — which is gap_resolution_policy in Policy Gap Analysis; nor does it discover hazards by enacting them live, the sampling_probe of Scenario Tabletop Review.
Related¶
- Instantiates: Completeness Audit — it keeps a standing coverage artifact complete, owned, and current.
- Sibling mechanisms: Coverage Checklist Walkthrough · Data Completeness Check · Policy Gap Analysis · Scenario Tabletop Review · Stakeholder Inclusion Review · Test Coverage Audit · Requirements Traceability Matrix
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Risk Register Review operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it uses a risk register to reveal unlisted hazards, uncovered mitigations, ignored scenarios, or risk categories without owners.
Independent corroboration: The frozen evidence defines Risk Register Review as 'Uses a risk register to reveal unlisted hazards, uncovered mitigations, ignored scenarios, or risk categories without owners', so its operative form is Assessment, Review & Assurance.
Nearest alternative: Record, Log & Register — Risk Register Review includes features of a persistent ledger, log, register, or case record that preserves history and traceability, but its defining operation is a bounded evaluation of existing evidence or work that produces a finding or disposition.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Organizational & Management Science
Origin pattern: Convergent development
Present-day reach: Universal
Rationale: Reviewing registers for omitted hazards and ownerless controls is enterprise risk governance.
Related originating lineages:
- Accounting & Auditing — Risk-based audit materially examines ownership and control gaps.
- Engineering & Design — Hazard-review practice independently checks scenario and mitigation coverage.
- Systems Thinking & Cybernetics — Systems thinking, feedback control, and cybernetics supplies a parallel or contributing lineage for the mechanism's defining operation: uses a risk register to reveal unlisted hazards, uncovered mitigations, ignored scenarios, or risk categories without owners.
Review resolution: Both blind reviewers agree that organizational_management is the primary historical origin. Explicit reconciliation of alternate origin disagreement, origin mode disagreement, domain reach disagreement starts from reviewer_a’s mechanism-specific evidence: Reviewing registers for omitted hazards and ownerless controls is enterprise risk governance. Reviewer A proposed alternates=accounting_auditing, engineering_design, origin_mode=convergent, domain_reach=universal, and encyclopedia_synthesis=true; reviewer B proposed alternates=systems_cybernetics, origin_mode=single_lineage, domain_reach=multi_domain, and encyclopedia_synthesis=true. The final record retains every independently supported alternate from either review (accounting_auditing, engineering_design, systems_cybernetics) without an arbitrary cap, selects origin_mode=convergent to represent the combined lineage evidence, and keeps domain_reach=universal and encyclopedia_synthesis=true from the more mechanism-specific assessment. Present-day transfer is recorded as reach and is not treated as proof of historical origin.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
The review's value depends almost entirely on its cross-check source. Compared only against itself, a register drifts into a tidy fiction: ownership assigned, statuses green, and none of it tested against the plant as it actually runs. The external hazard study is what makes the coverage map an audit rather than a self-attestation.
[n1] A HAZOP (Hazard and Operability Study) is a structured, guideword-driven examination of a process to identify hazards and operability problems. It is a standard external source against which a risk register can be cross-checked, precisely because it enumerates hazards independently of whatever the register already happens to list. ↩