2 April 2026

How to read a financial risk register without drowning in ratings

Severity labels only help when you know what evidence sits behind them and which findings need board time versus finance-team fixes.

A risk register is not a scoreboard. It is a structured list of exposures, each tied to evidence from sampling, interviews, or document review. Boards that treat every “high” the same way often miss the findings that actually threaten cash or reporting integrity.

Look at impact before likelihood

A remote-but-severe liquidity cliff deserves more board minutes than a frequent-but-minor coding error in expense categories. Ask which findings change covenant headroom, payroll timing, or the truthfulness of the monthly pack.

Ask for the evidence trail

Every rated item in our registers cites a workpaper reference — a sample sheet, a contract clause, an interview note. If a rating feels overstated, ask to see that trail. Good auditors explain their judgment; they do not hide behind color codes.

Separate remediation owners

Some fixes belong to AP clerks (dual approval on FX payments). Others belong to the CFO (renegotiating customer terms that create concentration). Mixing them into one undifferentiated action list guarantees that nothing moves. Assign names and dates before the closing meeting ends.