Governance practice · Practical guide

Linking Committee Decisions to a Risk Register

Translate governance decisions into risk ownership, controls and review evidence without overstating assurance.

Separate decisions from risk assessments

A decision register records what an authorised body resolved. A risk register records an uncertain event, potential consequences, controls, accountable owner and review status. Neither should be used as a substitute for the other. Link them using stable identifiers, but do not claim that passing a resolution eliminates a risk. The residual risk may remain high until controls are implemented and tested.

Capture the decision's risk assumptions

For material proposals, ask which risk the decision addresses, what assumptions informed it and which alternative was considered. Where appropriate, record a risk identifier in the agenda paper or decision register, not a lengthy sensitive risk narrative in public minutes. Distinguish the person authorised to accept a risk from the person tasked with implementing a control.

Build traceable follow-up

For each mitigation action, record its owner, due date, dependency, evidence requirement and escalation threshold. When the action is completed, assess whether the control actually works. An invoice for a purchased system proves procurement, not that the system reduced cyber risk. Schedule a risk reassessment and record the date, method and remaining exposure.

Fictional example and control

A fictional cultural society approves stronger backup arrangements after identifying loss-of-records risk. The action register records a vendor selection task and a restore-test task. The first is closed when the contract is approved; the second remains open until an authorised person observes a successful restoration. The risk owner updates the assessment based on test evidence, rather than marking the risk closed at contract signature.

Review at the next committee meeting

Report overdue controls, changed assumptions and decisions needed from the board. Restrict sensitive vulnerability details to authorised readers. The secretary should ensure links point to the current approved decision and that superseded risk assessments remain distinguishable from the current assessment.

This is general operational guidance, not legal advice. Follow governing documents and applicable law. All examples are fictional. SecretAIry's interactive demo does not access customer records.