A cyber risk register becomes easier to discuss when a record explains what could happen to the organisation. In our fictional example, stolen administrator credentials could interrupt customer services. That gives the board a consequence to consider alongside the technical issue. The record also names an owner, records existing controls and identifies the evidence behind the current assessment.
Separate the score from the evidence
Our example records initial likelihood 4 and impact 5, then current likelihood 3 and impact 5. The current score is 15. Within this template that is Critical. It is a prioritisation label, not a financial-loss estimate or a measured probability. The accompanying evidence says MFA is enabled but the access review is incomplete. That explanation matters as much as the colour.
Make the decision visible
The example requests two engineering days for an access review. Approval remains Pending. A board report can distinguish a proposed response from an approved commitment, and distinguish evidence that a control exists from evidence that it works. The highest score is useful context; it does not replace the decision.
Keep the summary accountable to its source
The kit calculates active-risk counts, current bands, overdue actions and reviews, and the five highest-scored active risks. Closed records are excluded, while Accepted risks remain active. Missing or invalid current scores remain unscored. One useful reporting check is to reconcile the summary to the register and explain any important issue outside the top five.
Inspect the example
The free four-page Word sample shows the fictional board discussion: https://payhip.com/b/7Yw4N
The full Excel kit is £29 for one organisation: https://payhip.com/b/b8dPV
It contains a 100-record blank workbook, a six-risk worked example, a Word guide and a worked board report. The Word report is manually maintained. No macros, automatic historical trends or audit certification are included.