Risk Assessment Register Template WORD

Standard Operating Procedure: Enterprise Risk Assessment Register Deployment & Governance

Document ID: SOP-TR-ENG-042
Effective Date: October 24, 2023
Version: 3.2.1
Review Cadence: Annual

---

1. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional protocol for authoring, validating, deploying, and maintaining the Risk Assessment Register template in Microsoft Word (.docx) format across Template Registry enterprise environments.

The purpose of this procedure is to establish an immutable baseline for risk documentation, ensuring strict alignment with ISO 31000 risk management standards, regulatory compliance frameworks, and internal audit requirements. Standardization prevents metadata corruption, enforces strict version control, and guarantees structural integrity for downstream automated parsing pipelines.

---

2. Scope & Prerequisites

2.1 Scope

This procedure applies to all engineering divisions, project management offices (PMOs), information security teams, and compliance officers within Template Registry. It governs any risk register document destined for internal governance reviews, client audits, or regulatory submissions.

2.2 Prerequisites & Environment

• Software Environment: Microsoft Office 365 ProPlus (Word Version 2304 or later) or LibreOffice Writer 7.5+ (Strict .docx compatibility mode).
• Required Assets:
  • Master Template Base: TR_Enterprise_Risk_Register_Master_v3.docx
  • Typography Package: Aptos / Aptos Display (Enterprise Standard) or Arial (Fallback).
• Access Control: Write permissions to the Template Registry Global Governance Repository (//repo.templateregistry.int/governance/risk/).
• Hardware/PPE: Standard office workstation; no specialized industrial PPE required.

---

3. Roles & Responsibilities

---

4. Step-by-Step Procedure

Phase 1: Environment Initialization & Asset Acquisition

• 1.1 Navigate to the secure repository at //repo.templateregistry.int/governance/risk/ and check out the latest master template revision (TR_Enterprise_Risk_Register_Master_v3.docx).
• 1.2 Verify that macro-execution is disabled within the local Word application environment to prevent execution of unauthorized VBA payloads.
• 1.3 Instantiate a local working copy, appending the target project identifier and ISO date string (e.g., TR_Risk_Register_[ProjectID]_[YYYYMMDD].docx).
• 1.4 Open the document navigation pane (View > Navigation Pane) to inspect the embedded Heading hierarchy.

Phase 2: Document Control & Metadata Configuration

• 2.1 Update the Document Control Block on Page 1, replacing placeholder tokens ([Project Name], [Author ID], [Date]) with verified system data.
• 2.2 Access Word’s internal metadata registry via File > Info > Properties and populate the Title, Author, Company (Template Registry), and Manager fields.
• 2.3 Lock the Document Control table fields against accidental modification by selecting the table and applying Content Control > Cannot be edited.

Phase 3: Structural Population of the Risk Matrix

• 3.1 Navigate to Section 4 (Risk Register Log) containing the primary 7-column enterprise matrix table.
• 3.2 Ensure the table headers strictly match the mandatory schema: Risk ID, Category, Risk Description, Inherent Likelihood (1-5), Inherent Impact (1-5), Inherent Risk Score, and Mitigation Strategy.
• 3.3 Populate risk entries sequentially utilizing alphanumeric nomenclature (e.g., RSK-SEC-001 for Security, RSK-OPS-002 for Operations).
• 3.4 Calculate the Inherent Risk Score by applying the mandatory formula: $\text{Score} = \text{Likelihood} \times \text{Impact}$.
• 3.5 Apply conditional shading formatting manually if macro automation is absent: Red for scores $\ge 15$, Amber for $8-14$, Green for $\le 7$.

Phase 4: Validation, Compliance Check, and Archival

• 4.1 Execute the Word Accessibility Checker via Review > Check Accessibility and resolve all high-priority structural warnings (e.g., missing table header rows, alt text errors).
• 4.2 Perform a visual layout inspection at 100% zoom to verify that no table borders overflow the standard 1-inch page margins.
• 4.3 Export a read-only distribution copy in PDF/A-1b format for external audit ingestion (File > Export > Create PDF/XPS).
• 4.4 Check the final validated .docx and .pdf files back into the Template Registry repository under the project’s immutable release tag.

---

5. Quality Assurance & Pro-Tips

5.1 Best Practices

• Never use unstyled tables: Always apply the built-in Word style TR-Enterprise-Grid to maintain CSS/XML structural parity across exports.
• Preserve XML integrity: Avoid pasting unformatted text directly from web browsers into table cells; use Ctrl + Shift + V (Keep Text Only) to strip malicious or legacy XML tags.
• Dynamic Fields: Use Word's native PAGE and NUMPAGES fields in the footer rather than hardcoding page numbers.

5.2 Common Pitfalls

• Broken Formulas: Avoid embedding dynamic Excel worksheet objects inside Word tables; they frequently break upon conversion to PDF/A formats. Use static calculated values per enterprise policy.
• Margin Creep: Do not alter the base document margins (1.0 inch all around). Doing so disrupts automated header/footer binding protocols.

5.3 Metric Thresholds

• Accessibility Score: 100% compliance required on the Microsoft Accessibility Checker tool.
• Orphan/Widow Control: Zero tolerance for single lines of text straddling page breaks within risk description cells.

---

6. Frequently Asked Questions (FAQ)

Q1: What should I do if the risk score calculation fields display syntax errors or raw field codes (e.g., { = ... })?
A: This occurs when Word toggles field code visibility. Press Alt + F9 to toggle the view back to normal text rendering. If the error persists, select the affected cell, press F9 to force a field update, or manually recalculate the product of Likelihood and Impact.

Q2: Can I add custom columns to the standard 7-column risk matrix table?
A: No. The 7-column schema is standardized across Template Registry to support automated data ingestion by our Enterprise Risk Management (ERM) software pipeline. If additional tracking metrics are required, append them to a separate supplementary appendix section following the main register.

Q3: How do I handle multi-page risk descriptions without breaking table header repetition?
A: Ensure that the top header row of the risk register table has the "Repeat as header row at the top of each page" property checked (Table Design / Layout > Properties > Row > Repeat as header row). Never split a single risk entry across non-contiguous pages manually using hard page breaks.