New Zealand Standards Aligned Risk Register Template

Standard Operating Procedure: Risk Register Administration (NZ Standards Alignment)

1. Executive Summary & Purpose

This document mandates the standardized process for establishing, maintaining, and reviewing a Risk Register within the New Zealand operational context. It ensures compliance with AS/NZS ISO 31000:2018 (Risk Management — Guidelines). The purpose is to provide a central repository for identifying, assessing, and mitigating operational threats to ensure business continuity and regulatory compliance.

2. Scope & Prerequisites

• Scope: Applicable to all departments, projects, and external contractors under Template Registry oversight.
• Software Requirements: Microsoft Excel (v2019+), SharePoint Online, or enterprise GRC platforms (e.g., ServiceNow/LogicGate).
• Prerequisites: Risk Management Policy (DOC-POL-001) must be acknowledged. Access to the secure Project Management Office (PMO) folder is required.

3. Roles & Responsibilities (RACI)

4. Step-by-Step Procedure

Phase I: Initiation & Identification

• Establish the context (Strategic, Operational, or Project-level).
• Conduct a brainstorming session with key stakeholders using a PESTLE framework (Political, Economic, Social, Technological, Legal, Environmental).
• Log risk descriptions using the format: "Cause -> Event -> Consequence."

Phase II: Analysis & Evaluation

• Assign a Likelihood score (1: Rare to 5: Almost Certain).
• Assign a Consequence score (1: Insignificant to 5: Catastrophic) based on NZ Health & Safety / Financial impact scales.
• Calculate the Inherent Risk Rating (Likelihood x Consequence).

Phase III: Mitigation Planning

• Define treatment strategy: (Avoid, Transfer, Mitigate, or Accept).
• Assign a clear Risk Owner (must be an individual, not a department).
• Set a "Target Review Date" and "Residual Risk Rating" (post-mitigation).

Phase IV: Continuous Monitoring

• Update register status bi-weekly during project status meetings.
• Escalate "High" and "Critical" risks to the Executive Steering Committee immediately.

5. Quality Assurance & Pro-Tips

• Clinical Precision: Avoid vague descriptions like "project delay." Use specific impact metrics (e.g., "Project delay > 14 days resulting in liquidated damages exceeding $50k").
• Metric Threshold: Any risk rated 15 or higher (High/Extreme) must have an active, dated mitigation plan.
• Pro-Tip: Utilize a "Traffic Light" Conditional Formatting in Excel (Red > 12, Amber 5-12, Green < 5) for immediate visual audit capability.
• Common Pitfall: Treating "Issues" (occurred events) as "Risks" (future possibilities). Keep an Issue Log separate from the Risk Register.

6. Frequently Asked Questions

Q: How do I handle "Risk Appetite" within the register? A: Risk appetite is determined by the Board. If the Residual Risk Rating exceeds the defined organizational appetite, the project must not proceed without formal sign-off from the Risk Committee.

Q: Is there a specific template format mandated for NZ compliance? A: While no single software is mandated, the structure must capture: ID, Description, Likelihood, Consequence, Risk Score, Mitigation Actions, Risk Owner, and Residual Risk score as per ISO 31000 standards.

Authorized by: Julian Vance Chief Architect, Template Registry