1 · Establish the facts
Confirm scope, systems, account owners and available evidence.
Sample risk register & roadmap
Illustrative only. Fictional organization and scenario. This is not a client case study, completed assessment or claim of client results.
Scenario: a growing service company uses cloud applications and an external IT provider. The example considers the departure of a user with administrative access.
| Risk | Access retained after departure could allow unauthorized changes or disclosure. |
|---|---|
| Evidence to request | Current privileged-account inventory, leaver process, selected access-removal records and authentication settings. |
| Assessment status | Unassessed: likelihood, impact and existing controls require evidence and client validation. |
| Suggested action | Assign an owner and reconcile privileged access; agree a leaver checklist and a review process. |
| Acceptance evidence | Approved inventory, recorded access removals and reviewed checklist samples. |
| Decision | Client risk owner confirms treatment and any residual risk acceptance. |
Illustrative sequence
2 · Agree action
Prioritize confirmed gaps with the client; assign owners and realistic dates.
3 · Verify progress
Review completion evidence and record remaining limitations or decisions.
The format, rating method and deliverables are agreed for each engagement. No universal risk rating or deadline is implied.
Discuss a QuickScan