Enterprise Risk Management

How to Write a Risk Statement: Examples for Your Risk Register

A writing pattern for risk register entries, the two mistakes it catches, three worked rewrites and a short edit to run on your own register.

By Eric Kennedy · Thu Nov 12 2026 · 10 min read

ILLUSTRATIVE SCENARIO. Here is a register entry as it often arrives: "Talent risk." Here is the same entry after an edit: "Because only one specialist can run off-cycle payroll adjustments, an absence during a pay-period close in the next 12 months could leave hourly staff paid late or incorrectly, missing the goal of accurate, on-time pay."

The first version names a topic. On its own, that label gives the reader little to assess or act on. The second names a condition that is true today, an event that may or may not happen, a consequence, the objective it threatens and a time horizon. A reader can now ask useful questions. Is the specialist really the only person who can run those adjustments? When is the next close? Would a late run affect every employee or only some? Those questions are the point of a good risk statement.

This guide gives you a writing pattern, the mistakes it catches, three worked rewrites and a short editing task you can run on your own register this week.

The pattern: condition, event, consequence, objective

Write each risk as one sentence with this shape:

Because [condition that is true now], [uncertain event] in [time horizon] could [consequence], affecting [named objective].

HM Treasury's Orange Book, the UK government's risk guidance, says in Annex 5 that risk is usually expressed in terms of causes, potential events and their consequences. NASA's Systems Engineering Handbook section on technical risk management describes risk through scenarios that move a system or process from its current state toward an undesired future state, along with their likelihood and consequences, and asks teams to prepare clear risk statements. Neither document binds a private company, and neither proves that a particular wording improves results. Both offer useful ways to connect an uncertain event to its consequences. The sentence pattern below is a practical editing aid, not a required formula from either source.

I use "condition" rather than "cause" in the sentence. A condition is a fact you can check today. "Cause" invites people to write speculation as if it were established.

Reading the anatomy

The graphic shows one sentence in five parts, each answering a different question: Condition (true today), Event (uncertain), Horizon, Consequence and Objective. Its legend reads "Solid highlight: true today" and "Dashed outline: uncertain." The solid highlight marks the only part you already know: the dependency on one specialist. The dashed outline marks the uncertain part, the absence during a close. Keeping those visually and grammatically apart is most of the discipline. The horizon tells the reviewer how far ahead to look, so "in the next 12 months" and "over the life of the contract" can be compared honestly. The consequence describes what happens to people or operations. The objective ties it back to something management has already committed to, which is what lets the risk compete for attention against other risks.

Two mistakes the pattern catches

The Orange Book names both. The first is writing a consequence as if it were the risk. "Customer churn," "margin erosion" and "regulatory fine" are outcomes. They tell you nothing about where to intervene, because many different conditions could produce each one.

The second is writing the inverse of an objective. "Failure to hit the revenue plan" or "inability to retain staff" restates the goal with a negative in front of it. Every objective has an inverse, so a register built this way grows long without telling anyone anything new.

A quick test: if you can create the entry by putting "failure to" in front of a line in the budget, or by naming a bad outcome, rewrite it.

Separate what is true now from what might happen

A risk statement describes uncertainty. If the event has already happened, it is an issue, and it needs an incident owner and an action plan rather than a likelihood rating. Mixed entries cause real confusion. "Key supplier failing quality checks" could mean the supplier has already failed two inspections, or that it might start failing. Those require different responses.

The pattern forces the split. The known fact goes in the condition. The uncertain occurrence goes in the event. If you cannot find anything uncertain left to write, move the entry to the issues log. One caution: an existing issue can still create future risk. Record the known issue and the uncertain consequence separately, rather than dropping the ongoing exposure from the register.

Keep controls and actions out of the sentence

People often load the statement with what is being done about it: "Talent risk, mitigated by cross-training plan due Q3." That buries three different things in one field. The statement should describe exposure. Existing controls, planned actions, the risk owner and the action owners, due dates and ratings each belong in their own field, so each can be checked on its own.

Separation also protects the assessment. If the planned cross-training is written into the statement, a reviewer can easily rate the risk as though training were already complete. Rating current exposure separately from the target is the subject of the residual risk guide.

Do not write numbers you do not have

A good statement does not need a probability or a loss estimate. Writing "20 percent chance of a $2 million loss" when nobody has done the analysis makes the entry look more precise than the evidence behind it. Describe the consequence in operational terms first. Add a range later, when someone has actually done the analysis and can show the inputs.

Three worked rewrites

ILLUSTRATIVE SCENARIO. All three examples below are constructed for teaching. They do not describe a client or a real result.

Payroll continuity. Before: "Talent risk." After: the payroll sentence above. Evidence that would weaken it: a second person who has run off-cycle adjustments without help in the past year, or a documented procedure someone else has used successfully.

Supplier quality and customer delivery. Before: "Supplier risk." After: "Because our only supplier of a machined housing failed two incoming inspections this year, another quality escape in the next two quarters could stop the assembly line, delaying deliveries promised for the spring launch." Evidence that would weaken it: recent inspection results showing the failures were traced and fixed, or a second qualified supplier that can ship within the launch window.

Pricing and renewal margin. Before: "Margin pressure." After: "Because renewal quotes still use last year's rate card while delivery costs have risen, renewals signed in the next two quarters could lock in prices below cost to serve, putting this year's gross margin target at risk." Evidence that would weaken it: a comparison of recent renewal prices against current cost to serve showing a healthy gap.

How to use the clinic

The clinic takes two register entries and rewrites them so someone can test them. Each card has three rows. The struck-through label is the starting entry. The rewrite is the full statement. The "Check" line is the evidence a reviewer would pull to test the causal story, and it is the most useful row on the card. If nobody can say what would weaken a statement, it is an opinion and should be treated as one.

All three rewrites side by side

When to split a statement, and when to merge

Split an entry when its parts have different conditions, need different actions or belong to different owners. For example, "Supplier risk" could cover a quality problem at one supplier and a capacity problem at another. Keep them separate if they need different evidence, responses or accountable owners.

Merge entries when several lines share the same condition and the same response. Three entries for "AP clerk leaving," "payroll clerk leaving" and "controller leaving" may belong together if the real condition is the same thin bench across the finance team and the response is one staffing decision. If each role needs a different fix, keep them apart.

The Orange Book's tables show one event with several causes and several consequences. That is a useful reminder that the sentence is a summary. Keep the supporting detail in the record, and keep the sentence to the main path.

A clear sentence is not evidence

A well-written statement can still be wrong. Good wording makes a causal story testable. It does not prove the story. The condition might be out of date. The event might be far less plausible than it sounds. The consequence might be smaller because a workaround exists that nobody mentioned.

So treat every rewrite as a claim and ask what would disprove it. In executive risk interviews, ask "what would have to be true for this to happen?" before asking how worried someone is. In a risk workshop, asking the room to name the evidence for a statement before rating it gives participants a shared basis for challenging the score.

The honest counterpoint: short labels have a place

A heat map or a one-page dashboard needs shorter display text than a detailed register. Short labels such as "Payroll single point of failure" are fine as display names, provided each one links to the full statement in the register. The problem is a register that holds only labels, because then nobody can check what the label means.

A 20-minute edit for your own register

Pick your five highest-rated risks. For each one:

1. Underline the condition. If there is none, or it cannot be checked today, write one or flag the entry.
2. Circle the uncertain event. If nothing uncertain remains, move it to the issues log.
3. Name the objective and the horizon.
4. Move any controls, actions and dates into their own fields.
5. Write one line of evidence that would weaken the statement.

Some entries may need to split or merge; others may describe issues rather than future uncertainty. Revisit any rating whose scope changed during the edit. If the edit shows that the register itself needs work, the enterprise risk assessment guide covers how to rebuild one around decisions.

If you want a quick read on whether your current risk reporting gives leadership something it can act on, the scorecard asks seven questions, takes about two minutes and shows where the gaps are.

Take the Risk Reporting Scorecard