Risk Register Builder
Every GRC program starts with a risk register. It is the single document that connects business objectives to security controls. Without it, compliance work is checkbox theater — you are implementing controls without knowing what you are protecting against.
In this exercise, you will read a business scenario and build a risk register from scratch. For each risk you identify, you will rate its likelihood and impact, classify it, and propose a mitigation.
How to think about risk scoring
Likelihood (1–5) measures how often you expect the risk to materialize. Impact (1–5) measures the damage when it does. The risk score (likelihood x impact) determines priority: 1–4 is low, 5–9 is medium, 10–15 is high, 16–25 is critical. A risk with likelihood 2 and impact 5 (score 10) may be more important than one with likelihood 4 and impact 3 (score 12) — the score is a starting point, not the final word.
Exercise
~25 min
Build a risk register for this business scenario
Scenario
MedVault — Series B SaaS expanding to EU
MedVault is a 50-person Series B health-tech startup based in Austin, TX. They provide a cloud-based platform for small medical practices to manage patient intake forms, appointment scheduling, and billing. They currently serve 400 US practices and are preparing to expand to the EU market in Q3. The board has approved a $2M budget for compliance and international expansion.
Currently SOC 2 Type I certified (Type II audit scheduled for Q4)
All infrastructure runs on AWS us-east-1 (single region)
No Data Protection Officer (DPO) appointed yet
Patient health data (PHI) stored in PostgreSQL with AES-256 encryption at rest
3 engineers on the platform team, 12 total in engineering
Using GitHub Actions for CI/CD with manual production deploys
No formal incident response plan documented
Employee laptops are company-issued but not MDM-enrolled
Third-party billing integration with Stripe and a smaller clearinghouse API
Identify 3–5 risks. For each: name it, describe it, rate likelihood and impact (1–5), choose a category, and propose a mitigation.
Risk 1
Category
Likelihood: Possible
Impact: Moderate
Risk Score: 9
Risk 2
Category
Likelihood: Possible
Impact: Moderate
Risk Score: 9
Risk 3
Category
Likelihood: Possible
Impact: Moderate
Risk Score: 9
Risk Matrix
5
4
3
2
1
1
2
3
4
5
Likelihood
Impact