Risk Register Template Sharepoint

Standard Operating Procedure: Enterprise Risk Register Provisioning & Governance via SharePoint

1. Document Control Block

• Document ID: SOP-TR-ENG-089
• Effective Date: October 24, 2023
• Version: 4.2.0
• Review Cadence: Annual / Post-Incident
• Owner: Julian Vance, Chief Architect, Template Registry

---

2. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional engineering standard for architecting, deploying, and governing centralized Risk Register templates within the Enterprise SharePoint Online ecosystem at Template Registry.

The purpose of this procedure is to eliminate data silos, enforce standardized risk taxonomy, ensure granular Role-Based Access Control (RBAC), and establish automated audit trails for operational, technical, and compliance risk vectors across all engineering divisions.

---

3. Scope & Prerequisites

Scope

This procedure applies to all SharePoint site collections designated for project, product, and infrastructure lifecycles managed within Template Registry.

Prerequisites

• Permissions: Global SharePoint Administrator or Site Collection Administrator (SCA) entitlements.
• Software: Microsoft 365 Enterprise (E5 License tier recommended for advanced governance), SharePoint Online Management Shell (PowerShell v7.x+).
• Artifacts: Approved Template Registry Enterprise Risk Taxonomy JSON schema, corporate branding assets.

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Procedure

Phase 1: Site Architecture & Infrastructure Setup

• 1.1 Provision a dedicated, modern SharePoint Communication Site or Team Site designated strictly for Risk Governance (https://templateregistry.sharepoint.com/sites/EnterpriseRiskRegistry).
• 1.2 Disable inheritance on site-level permissions and establish security groups mirroring the RACI matrix (TR-Risk-Admins, TR-Risk-Contributors, TR-Risk-Viewers).
• 1.3 Apply site classification sensitivity labels (Confidential // Restricted) in compliance with Template Registry Data Loss Prevention (DLP) policies.

Phase 2: Schema Configuration & List Deployment

• 2.1 Create a custom SharePoint List titled Enterprise_Risk_Register_Master.
• 2.2 Configure the core metadata columns utilizing exact internal system names to prevent API mapping drift:
  • RiskID (Data Type: Single line of text, Indexed, Auto-generated via Power Automate)
  • RiskDescription (Data Type: Multiple lines of text, Plain text)
  • RiskCategory (Data Type: Choice [Strategic, Operational, Financial, Technical, Compliance])
  • Probability (Data Type: Choice [1 - Rare, 2 - Unlikely, 3 - Possible, 4 - Likely, 5 - Almost Certain])
  • Impact (Data Type: Choice [1 - Negligible, 2 - Minor, 3 - Moderate, 4 - Major, 5 - Critical])
  • RiskScore (Data Type: Calculated, Formula: =[Probability]*[Impact])
  • MitigationStrategy (Data Type: Multiple lines of text)
  • RiskOwner (Data Type: Person or Group)
  • RiskStatus (Data Type: Choice [Open, Mitigated, Accepted, Transferred, Closed])
• 2.3 Implement column-level validation settings to ensure MitigationStrategy is mandatory when RiskScore >= 15.

Phase 3: View Optimization & Dashboarding

• 3.1 Construct a custom "Executive Summary" view utilizing JSON formatting to color-code rows based on RiskScore thresholds (Red for >= 15, Amber for 8-14, Green for < 8).
• 3.2 Establish a "My Active Risks" view filtered by [Me] in the RiskOwner field and RiskStatus equals "Open".
• 3.3 Embed the SharePoint List web part into the site homepage, configured to display top high-severity risks sorted descending by RiskScore.

Phase 4: Automation & Compliance Integration

• 4.1 Deploy an automated Power Automate cloud flow (FL-TR-Risk-Escalation) triggered upon item creation where RiskScore >= 20, executing an immediate notification to the Information Security Officer and Accountable Risk Manager.
• 4.2 Configure SharePoint Versioning settings to retain a minimum of 100 major versions and 50 minor versions for immutable audit tracking.
• 4.3 Save the configured list as a site template (.pnp or list template .stp) and publish it to the Template Registry App Catalog for enterprise-wide deployment.

---

6. Quality Assurance & Pro-Tips

Pro-Tips for System Architects

• Index Delegation: Always index lookup and choice columns (RiskCategory, RiskOwner, RiskStatus) immediately upon list creation to prevent SharePoint throttling (Threshold limit: 5,000 items per view query).
• Taxonomy Consistency: Do not use out-of-the-box metadata terms if you plan to scale across site collections; utilize Managed Metadata Services (MMS) term stores for global risk categorizations.

Common Pitfalls

• Broken Inheritance: Avoid assigning direct user permissions at the list item level. Enforce group-based access control via Azure Active Directory (Entra ID) security groups.
• Calculated Column Lag: Be aware that SharePoint calculated columns (RiskScore) do not trigger workflow events natively upon recalculation; design Power Automate triggers around Modified metadata instead.

Metric Thresholds

• Query Latency: List view render time must not exceed 1.2 seconds under standard load.
• Audit Compliance: 100% of risks scored >= 15 must have an assigned mitigation owner within 24 business hours.

---

7. Frequently Asked Questions (FAQ)

Q1: How do I handle permissions if external auditors require temporary read-only access to specific risk registers?
A1: Do not invite auditors directly to the site collection. Create a dedicated guest-enabled Azure AD security group (TR-Auditor-Access), grant them "Read" permissions exclusively to the Enterprise_Risk_Register_Master list via unique list-level permissions, and enforce an automated expiration policy on the guest account within 30 days.

Q2: What is the remediation protocol if the calculated RiskScore fails to update automatically?
A2: SharePoint calculated columns update only when an item is programmatically or manually resaved. If a batch update occurs via migration or bulk edit, execute a minor PowerShell script utilizing the PnP.PowerShell module to touch and update the Modified field, forcing the SharePoint SQL backend to recalculate the row indices.