Nonprofit Risk Register Template: Inherent vs Residual Risk

Residual risk scores often drop on paper the moment a control is listed, even when nobody has checked the control works.

Inherent risk is the exposure before controls: how likely, and how bad. Residual risk is what remains with the controls actually operating. The gap between them should be a judgment someone can explain, not an automatic discount. On a 5x5 grid a risk might move from 20 CRITICAL to 12 HIGH, but only if the controls behind that move exist, have an owner and have been reviewed. And a register that lists risks without actions tells the board what could go wrong, not who is handling it.

Our Risk Management OS for Excel and Google Sheets follows that rule. A control never lowers a score by itself, and a missing residual is labelled. Actions show OVERDUE, DUE SOON, BLOCKED, ON TRACK or COMPLETED. Incidents are logged separately and linked when a risk anticipated them, and the board report prints top risks, movement, open actions and incidents.

The board gets scores it can question, and names next to every open action.

The workflow is ISO 31000-aligned, not ISO certified, and it isn't legal, insurance or audit advice. Scores rank discussion. They aren't probabilities.