Risk Register Template

Risk Management Framework

Supporting this policy, Colleges and University Services will adhere to a consistent format when articulating and managing risk.

The University uses:

  • The template in Appendix A as the data capture for all risk registers
  • Guidance in Appendix B on the methodology for scoring risks
  • Guidance in Appendix C on how risk is rated and escalation
  • Guidance in Appendix D on our appetite for risk

The number of risks in a register is not fixed, however, at board level and above, this should be limited to the key risks that will directly impact on the delivery of the University strategy or services.

As part of the risk review cycle outlined in section 4, the review should include the deletion of risks that are no longer applicable, the introduction of new risks and the amendment of current risks.

The Risk Management Policy and Framework will be subject to annual review at the Audit and Risk Committee.  The Audit and Risk Committee will review the strategic risk register as well as evidence that the risk policy is being adhered to across the University.

The Audit and Risk Committee will review the effectiveness of the risk policy and risk management framework and may recommend an external review of the process.

It is the responsibility of the Director of Risk to ensure that the risk management framework is being adhered to and will escalate to the Director of Finance omissions or evidence of a lapse in risk management from operational risk registers.

Appendix A: risk register data description

Ref

A unique identifier.  This can be anything that makes sense to the risk register owner but should be sequential

Title

A very short title that makes it easy to understand what the risk is about

Date raised

What date was this initially added to the log.  This will help with the ageing profile of the register

Risk owner

Who will be ultimately accountable for the management of this risk?  This is not the person who will be responsible for completing the mitigating actions

Root cause

What are the reasons this risk could occur?  This is commonly written as “due to…”

Risk description

How would you describe the risk?  This is commonly written as “there is a risk that…”

Risk impact

What would happen if the risk happened?  This is commonly written as “this will result in…”

Strategy

How does this risk relate to our thematic and enabling strategies?  Refer to appendices C for a drop-down list of these strategies

Movement

Since the last review, is this risk:

RISING – the risk is becoming more likely, or the impact is bigger than you originally thought

STABLE – there is no change to the likelihood of the risk occurring or the impact it will have

IMPROVING – the risk is becoming less likely, or the impact is less than you originally thought

Mitigation

How will we manage this risk? 

RESOLVE – can we completely remove all likelihood that this risk will not happen or that there will be no impact to the University?

REDUCE – can we make it less likely that the risk will happen or, if it does, we can soften the impact to the University?

ACCEPT – is there nothing we can do to reduce or resolve the likelihood and probability?

TRANSFER – can we pass this to an external partner to resolved or reduce such as a sub-contractor to manage on our behalf?

Proximity

If the risk becomes a reality, how far in the future is that likely to happen?  It is common to use this alongside the initial probability, e.g., there is a 75% chance of this happening in 6 months to 1 year

Anytime

1 to 3 months

3 to 6 months

6 months to 1 year

More than 1 year

Initial impact

A score of 1 to 5.  Refer to appendices B for further details

Initial probability

If all actions were completed and controls are working, what would the probability score be? 

A score of 1 to 5:

1 (very Low) - 1% to 19% chance.  “there is not much chance of this happening”

2 (low) - 20% to 39% chance.  “we don’t think this will happen”

3 (medium) - 40% to 59% (or 50/50) chance.  “we don’t know if this will happen”

4 (high) – 60% to 79% chance.  “we are reasonably sure this will happen”

5 (almost certain) – 80% to 99% chance.  “we are almost certain this will happen”

Initial assessment

Initial impact * Initial probability

Mitigation control or action

Mitigations can take one of two forms:

Action – this will be a task with a clear output or outcome with a clearly defined due date.  Common words for an action include deliver, produce, run or set up

Control – this will be an operational or business as usual mitigation such as monthly review at a committee or board.  Controls do not have a due date but need to have a date when it will be reviewed to ensure the mitigation is effective

Mitigation description

A list of mitigations that will be undertaken to manage the risk.  A separate line should be created for each mitigation so that the owner can be assigned

Mitigation owner

A separate name who is responsible for each mitigation action or control

Action or review date

A separate date for each mitigation action or when the control will be reviewed again

Residual impact

If all actions were completed and controls are working, what would the impact score be?  Refer to appendices B for further details

Residual probability

If all actions were completed and controls are working, what would the probability score be? 

A score of 1 to 5:

1 (very Low) - 1% to 19% chance.  “there is not much chance of this happening”

2 (low) - 20% to 39% chance.  “we don’t think this will happen”

3 (medium) - 40% to 59% (or 50/50) chance.  “we don’t know if this will happen”

4 (high) – 60% to 79% chance.  “we are reasonably sure this will happen”

5 (almost certain) – 80% to 99% chance.  “we are almost certain this will happen”

Residual assessment

Residual impact * Residual probability

Escalation level

Using the escalation table in appendix D, what level in the University is this being managed?  Levels 1 to 3 are fixed, however, levels 4 to 7 can be changed to suit the audience of the risk register:

Level 1 – Audit and Risk Committee/Court

Level 2 – Senior Management Group

Level 3 – College Management Group, Professional Services Group or Committee

The governance site contains all Terms of Reference for committees including escalation of risk

Status

Is this risk still open?

Last review

What was the last date that this risk was updated?

Notes

Freeform text to provide additional information or context

Appendix B: scoring methodology

 

Probability

1 - Very Low Probability

2 - Low Probability

3 - Medium Probability

4 - High Probability

5 - Almost Certain

 

1% to 19% chance of happening; there is not much likelihood this will happen

20% to 39% chance of happening; we don't think this will happen

40% to 59% chance of happening; we don't know if this will happen

60% to 79% chance of happening; we are reasonably sure this will happen

80% to 99% chance of happening; we are almost certain this will happen

 

Impact

1 - Very Low Impact

2 - Low Impact

3 - Medium Impact

4 - High Impact

5 – Highest Impact

Civic

 

 

 

 

 

Data

High trust - can be used for strategic purposes; GDPR unlikely to be impacted

High to moderate trust - can be used for management purposes; GDPR could be impacted and requires further review

Moderate trust - can be used for more than one operational purpose; GDPR highly likely to be impacted and requires action

Moderate - Low trust - can be used for single operational purpose; GDPR will be an issue and an action plan is required

Low trust - data is not fit for purpose; GDPR requirements will be not be met

Estates

Negligible environmental impact managed within operating budgets.  Nil or minor localised impacts to, ecosystems, water resources or air.  Impact does not require specific management of rehabilitation. Dust/Noise nuisance release

Environmental damage, requiring up to £100k to study or correct. Minor impact to ecosystems, water resources or air.  Damage is recoverable through short-term (less than 1 year) management and rehabilitation. On site release contained by organisation.

Temporary but localised effect on ecosystems, water resources or air.  Rectification required over medium-term (1-5 years).  Requiring £100k-£500k to study or correct.. On site release contained by organisation.

Major temporary effect on ecosystems, water resources or air.  Requiring £500k-£1million to study or correct.  Major temporary Rectification difficult but may be possible in the long term (5 years or longer). Release affecting minimal off-site area requiring external assistance (SFRS/RPS etc.)

Major permanent effect on ecosystems, water resources or air requiring £1million+ to study or correct.  Rectification difficult and unlikely to result in recovery. Toxic release affecting off-site with detrimental effect requiring external assistance.

External relations and reputation

Highly unlikely to cause adverse publicity

Unlikely to cause adverse publicity

Needs careful PR

Diverse local publicity/limited damage to University brand

Adverse national publicity/ongoing damage to University brand

Finance

Financial loss of £500k-£1m or more than £100k p.a.

Financial loss of £1-2m or more than £500k p.a.

 

Opportunities would result in less than £750k p.a cost saving or income generation

Financial loss of £3-5m or more than £750k p.a.; minor changes to current procurement or current supplier contracts required

 

Opportunities would result in more than £750k p.a cost saving or income generation

Financial loss of £5-10m or more than £1m p.a.; major changes to current procurement or current supplier contracts required

 

Opportunities would result in more than £1m p.a cost saving or income generation

Financial loss of >£10m or more than £2m p.a.; new procurement or new supplier contracts will be required

 

Opportunities would result in more than £2m p.a cost saving or income generation

Health and Safety

Minimal impact to health/welfare

Workplace safety compromised; significant impact to health/welfare

Litigation due to unsafe workplace; major impact to health/welfare; lost time <7 days

Serious injury or harm; dangerous near miss; significant publicity and litigation as a result; lost time >7 days

Death or permanent disability; long term impact to service; major publicity and litigation

Innovation

Minor impact on our Innovation Strategy

Would have a small impact on our ability to take advantage of commercialisation opportunities

Would have a major impact on the Innovation Strategy objectives

 

Opportunities may result in some commercialisation opportunities

Would have a significant impact on our ability to take advantage of commercialisation opportunities

Would result in us unable to achieve our Innovation Strategy

 

Opportunities would result in significant commercialisation opportunities

International

 

 

 

 

 

Learning and teaching

Minor impact on teaching activity

Short-term impact on teaching activity

Significant impact on teaching activity; loss of a key academic course;

Major impact on teaching activity; significant impact on a school

Unsustainable impact on teaching activity; significant impact on a College

People and OD

Minimal impact to staff wellbeing.  No visible impact to capacity and capability

An increase in wellbeing cases. Key roles are being impacted. Visible impact on service delivery and operations

Major impact to staff wellbeing.  Short term loss of key roles.  Significant impact to staff morale

Threat of staff industrial action.  Long term loss of key roles.  Significant impact to capacity and capability.  Highest impact on service delivery and operations

Widespread and sustained industrial action.  Long term impact to capacity and capability.  Complete loss of service delivery and operations

Research

Minor impact on research activity

Short-term impact on research activity

Significant impact on research activity

Major impact on research activity; significant impact on a school; short term damage to research funding

Unsustainable impact on research activity; significant impact on a College; irreparable damage to research funding

Services

Disruption (< 1 day) disruption to business critical services; no noticeable disruption to non-critical services

Disruption between 1 and 5 days disruption to business critical services; disruption < 10 days to non-critical services

Loss < 1 day disruption to business critical services; no loss to non-critical services

Loss (between 1 and 5 days) disruption to business critical services; loss (< 10 days) to non-critical services

Loss > 5 days of service to business critical services; loss > 10 days to non-business critical services

Student Experience

no noticeable impact on student experience

no impact to teaching; would lead to individual students raising concerns; no impact on NSS scores

minor disruption to teaching; would lead to a group of students raising concerns; low impact (1-2) years on NSS scores

significant disruption to teaching; would lead to individual students raising a formal complaint or leaving the University; medium impact (2-3 years) on NSS scores

teaching stopped in one or more School; would lead to a group of students raising formal complaints or leaving the University; long term impact (more than 3 years) on NSS scores

Student Recruitment

no noticeable impact on student recruitment

would lead to 1% and 3% of student recruitment markets not being met

would lead to 4% to 7% of student recruitment targets not being met

would lead to between 7% and 10% of student recruitment targets not being met

would lead to more than 10% of student recruitment targets not being met

Sustainability

No impact from a legal or reputational perspective

No legal impact but negligible reputational damage or discord within community

Could result in:

Minor fines or legal suits

Manageable reputational damage

Some discord within community

Negligible impact on staff and student recruitment and retention

Opportunities may have an indirect positive impact on our Sustainability Strategy

Could result in:

Major fines or legal suits

Reputational damage requiring careful PR

Noticeable discord within community

Some negative impact on staff and student recruitment and retention

Opportunities may have a direct positive impact on our Sustainability Strategy

Would definitely result in:

Major fines or legal suits

Significant reputational damage

Serious discord within community

Significant negative impact on staff and student recruitment and retention

Opportunities will definitely have a direct positive impact on our Sustainability Strategy

Technology/ IT

Negligible impact on technology systems, infrastructure or architecture

MInor impact on technology systems, infrastructure or architecture with a known solution or a medium term workaround fix.  There may be an impact on the delivery of the Technology Strategy

 

Opportunities would result in minor improvements to technology systems, infrastructure or architecture

Impact to technology systems, infrastructure or architecture that could be fixed with a short term workaround solution.  Minimal impact on the delivery of the Technology Strategy

 

Opportunities would result in significant improvements to technology systems, infrastructure or architecture

Major impact on technology systems, infrastructure or architecture that would require immediate remediation.  Key elements of the Technology Strategy would not be delivered.

 

Opportunities would result in significant improvements to technology systems, infrastructure or architecture

Untenable impact on technology systems, infrastructure or architecture.  Unable to achieve the delivery of the Technology Strategy

 

Opportunities would result in a transformational change to technology systems, infrastructure or architecture

Transformation

Minor impact on the Transformation Strategy

Would result in a delay or increase to cost within business case tolerances to a Transformation project.

Would result in a delay or increase to cost outside of business case tolerances but highly likely to be approved.  May result in minor inefficiencies to our processes or systems

 

Opportunities would have some impact to the Transformation Strategy. Would result in minor efficiency improvements to our processes or systems

Would result in a significant delay or increase to cost to a Transformation project.  May result in major inefficiencies to our processes or systems.

 

Opportunities would have a direct impact to the Transformation Strategy. 

Would result in the complete halt to a Transformation project.  The Transformation Strategy would not be able to meet stated goals.  Would result in unacceptable inefficiencies to our processes or systems

 

Opportunities would exceed the current expected benefits from the Transformation Strategy.  Would result in significant efficiency improvements to our processes or systems

 

Project – Finance and cost

Overspend of less than 1% of agreed budget

Overspend between 1% and 3% of agreed budget

Overspend between 3% and 5% of agreed budget; minor changes to current procurement or current supplier contracts required

Overspend between 5% and 10% of agreed budget; major changes to current procurement or current supplier contracts required.  Additional Capital Application required

Overspend of greater than 10% of agreed budget; new procurement or new supplier contracts will be required.  Additional Capital Application required

Project - Resources

 

 

 

 

 

Project – Scope and business case

Scope change or functionality/quality/ business case impact barely noticeable. 

Scope change or functionality/quality/business case impact noticeable but accepted by customer/end user

Scope change or functionality/quality/ business case noticeable and would require a minor change

Scope change or functionality/quality/business case noticeable and would require a major change

Scope change or functionality/quality/business case would not be accepted by the customer/end user

Project – Time and planning

Slippage of less than 2% of project lifecycle or less than 4 weeks.  Has no impact of the implementation of business activities.

Slippage between 3% and 10% of project lifecycle or between 1- and 2-months slippage.  Delay of up to two weeks for non-business critical activities and up to 2 days on business-critical activities.

Slippage between 10% and 15% of project lifecycle or between 2- and 3-months slippage.  Delay of up to 4 weeks for non-business critical and up to 1-week delay to business-critical activities.

Slippage between 15% and 20% of project lifecycle or between 3- and 6-months slippage.  Delay of up to 2 weeks for business-critical activities.

Slippage of greater than 20% of project lifecycle or more than 6 months slippage

Delay of greater than 2 weeks for business-critical activities.

Appendix C: escalation, categories and ratings

Escalation level

Examples

Level 1 (fixed)

Court and Audit and Risk Committee

Level 2 (fixed)

Senior Management Group

Level 3 (fixed)

College Management Groups, Professional Services Group, Governance Groups (as described in the corporate governance structure (www.gla.ac.uk/governance)

Level 4 (mandatory)

School, University Services Leadership Teams (e.g. People and OD, Commercial Services or Finance)

Level 5 (optional)

Teams or Programme Boards

Level 6 (optional)

Sub teams or Project Boards

Level 7 (optional)

Projects

 

 

1 - Very Low Impact

2 - Low Impact

3 - Medium Impact

4 – High impact

5 – Major impact

5 - Almost Certain

Medium

Medium

High

Major

Major

4 - Very High Probability

Low

Medium

High

High

Major

3 - Medium Probability

Low

Medium

Medium

High

High

2 - Low Probability

Low

Low

Medium

Medium

High

1 - Very Low Probability

Low

Low

Low

Low

Medium

Low risk:

Requires minimal attention.  Updated at next review date

Medium risk:

Should be reviewed and updated monthly to ensure that mitigation is effective

High risk:

Effective mitigation plan signed off at appropriate level and updated monthly to ensure that mitigation is effective

Major risk:

Requires immediate attention.  Effective mitigation plan signed off a level above or SMG/Audit and Risk Committee.  Updated regularly to ensure that mitigation is effective

 

Thematic strategies

Enabling strategies

Other

Civic engagement

Innovation

Internationalisation

Learning and teaching

Research

Student experience

Sustainability

Data and cybersecurity

Estates

Finance

People and Organisational Development

Services

Student recruitment

Technology/IT

Transformation

Health & Safety

External Relations

Student recruitment

Project finance and cost

Project resources

Project scope and business case

Project time and planning

 

Appendix D: risk appetite statements

Strategic theme AVERSE MINIMAL CAUTIOUS SEEKING
We will accept risk with a score of 1 -4 We will accept risk with a score of 5 - 9 We will accept risk with a score of 10 – 16 We will accept risk with a score of 20-25
 Definition Avoidance of risk and uncertainty is a key organisational objective Preference for safe options that have a low degree of risk and may only have limited potential for reward Willing to consider all potential options and choose the one most likely to result in successful delivery, while also providing an acceptable level of reward and value for money Eager to be innovative and to choose options offering potentially higher rewards despite greater inherent risks
Data The University will not compromise on its statutory obligations to store, interrogate or dispose of data.  There is no tolerance for information security risk causing loss or damage to University data      
Estates EXISITING ESTATE     CAMPUS DEVELOPMENT
The University will take all care of duties in the protection of the campus heritage and the fabric of our buildings The University will actively seek new and innovative usage of space
External Relations and reputation The University will not compromise its reputation and values in the short or long term      
Finance     Financial risks and rewards are to be weighed against short and long term strategic and operational priorities  
Health and Safety The University will not compromise any aspect of Health and Safety that puts any staff, student or member of the public at risk      
Innovation       The University's appetite for Academic and Technical innovation is that it should be competitive at the earliest opportunity to maintain its standing in local and global markets
Learning and Teaching     The University recognises that, although quality and integrity of output is paramount, it seeks to maintain and to benefit from ongoing developments in the definition and delivery of academic outputs The University's appetite for Academic and Technical innovation is that it should be competitive at the earliest opportunity to maintain its standing in local and global markets
People and OD The University will not compromise the wellbeing of its staff The University recognises trade union collaboration and will avoid industrial action as much as possible    
Research   The University recognises that, although quality and integrity of output is paramount, it seeks to maintain and to benefit from ongoing developments in the definition and delivery of academic outputs    The University's appetite for Academic and Technical innovation is that it should be competitive at the earliest opportunity to maintain its standing in local and global markets
Student experience   A positive and rewarding experience is of paramount importance to the University.  A small level of risk is acceptable if it demonstrates providing a more enriched and innovative experience to the student    
Services   The University seeks innovation and improvement but will not accept higher risk in the operation of key services    
Sustainability Threats     Opportunities
The University has zero tolerance for any adverse impact on the environment The University has a high tolerance for innovative and unique opportunities that actively contribute to our Sustainability Strategy and reduces our carbon footprint
Technology     The University seeks innovation and improvement but will not accept higher risk in the operation of key systems  
Transformation       The University's will actively seek opportunities for innovation and accept higher risk that would demonstrate excellence

Appendix C: Impact Statements

Impact 1 - Very Low Impact 2 - Low Impact 3 - Medium Impact 4 - High Impact 5 – Highest Impact
Civic Minor impact on Civic Engagement – very limited impact on civic and community partners. Short-term impact on Civic Engagement – limited impact on civic and community partners; contained to specific area of the University’s civic engagement Significant impact on Civic Engagement; significant impact on civic and community partners resulting in negative impact on institutional ability to meet civic engagement commitments. Major impact on Civic Engagement; major impact on civic and community partners resulting in inability to meet significant institutional commitments and the delivery of the University’s Civic Mission and its Civic Strategy Unsustainable impact on Civic Engagement involving a significant number of civic and community partners
Data  High trust - can be used for strategic purposes; GDPR unlikely to be impacted High to moderate trust - can be used for management purposes; GDPR could be impacted and requires further review Moderate trust - can be used for more than one operational purpose; GDPR highly likely to be impacted and requires action Moderate - Low trust - can be used for single operational purpose; GDPR will be an issue and an action plan is required Low trust - data is not fit for purpose; GDPR requirements will be not be met
Estates  Disruption of up to 1 day to business-critical services/estate; disruption of up to 5 days to non-critical services/estate; Disruption up to 5 days to business critical services/estate; disruption of up to 10 days to non-critical services/estate; Total loss of up to 1 day to business critical services/estate; total loss of up to 5 days to non-critical services/estate; Total loss of up to 5 days to business critical services/estate; total loss of up to 10 days to non-critical services/estate; Total loss over 5 days to business critical services/estate; total loss over 10 days to non-critical services/estate;
Infrastructure (heating/power/water) loss affecting a section of a building. Infrastructure (heating/power/water) loss affecting entire building. Infrastructure (heating/power/water) loss affecting up to half of campus area. Infrastructure (heating/power/water) loss affecting up to three-quarters of campus area. Infrastructure (heating/power/water) loss affecting more than three-quarters of campus area.
External relations and reputation Highly unlikely to cause adverse publicity Unlikely to cause adverse publicity Needs careful PR/Diverse local publicity Diverse local and national publicity/limited damage to University brand Adverse national and international publicity/sustained damage to University brand
Finance Financial loss of £500k-£1m or £100k-£500k per annum Financial loss of £1-2m or £500k-£750k per annum Financial loss of £3m-£5m or £750k-£1m per annum; Financial loss of £5-10m or £1m-£2m per annum;  Financial loss of >£10m or >£2m per annum; 
  minor changes to current procurement or current supplier contracts required major changes to current procurement or current supplier contracts required new procurement or new supplier contracts will be required
Opportunities would result in <£750k per annum cost saving or income generation Opportunities would result in £750k-£1m per annum cost saving or income generation Opportunities would result in £1m-£2m per annum  cost saving or income generation Opportunities would result in >£2m p.a cost saving or income generation
Health and Safety Minimal impact to health/welfare Workplace safety compromised; significant impact to health/welfare Litigation due to unsafe workplace; major impact to health/welfare; lost time <7 days Serious injury or harm; dangerous near miss; significant publicity and litigation as a result; lost time >7 days Death or permanent disability; long term impact to service; major publicity and litigation
Innovation Minor impact on our Innovation Strategy Would have a small impact on our ability to take advantage of commercialisation opportunities Would have a major impact on the Innovation Strategy objectives Would have a significant impact on our ability to take advantage of commercialisation opportunities Would result in us unable to achieve our Innovation Strategy
   
Opportunities may result in some commercialisation opportunities  Opportunities would result in significant commercialisation opportunities
International Minor impact on international activity which does not have widespread consequences for international strategy Short-term impact on international activity; minor impact on recruitment, research, reputation and partnership activity – contained to small region Significant impact on international activity; loss of significant income and detrimental to partnership activities, research and reputation in one region. Major impact on international activity; major impact on a partnership activity, research, reputation and recruitment in key geographical region or several regions. Unsustainable impact on international activity impacting several key regions.
Would result in inability to achieve our International Strategy or meet institutional targets.
Learning and teaching Minor impact on teaching activity Short-term impact on teaching activity Significant impact on teaching activity; loss of a key academic course; Major impact on teaching activity; significant impact on a school Unsustainable impact on teaching activity; significant impact on a College
People and OD Minimal impact to staff wellbeing.  No visible impact to capacity and capability An increase in wellbeing cases. Key roles are being impacted. Visible impact on service delivery and operations Major impact to staff wellbeing.  Short term loss of key roles.  Significant impact to staff morale Threat of staff industrial action.  Long term loss of key roles.  Significant impact to capacity and capability.  Highest impact on service delivery and operations Widespread and sustained industrial action.  Long term impact to capacity and capability.  Complete loss of service delivery and operations
Research Minor impact on research activity Short-term impact on research activity Significant impact on research activity Major impact on research activity; significant impact on a school; short term damage to research funding Unsustainable impact on research activity; significant impact on a College; irreparable damage to research funding
Services Disruption (< 1 day) disruption to business critical services; no noticeable disruption to non-critical services Disruption between 1 and 5 days disruption to business critical services; disruption < 10 days to non-critical services Loss < 1 day disruption to business critical services; no loss to non-critical services Loss (between 1 and 5 days) disruption to business critical services; loss (< 10 days) to non-critical services Loss > 5 days of service to business critical services; loss > 10 days to non-business critical services
Student Experience no noticeable impact on student experience no impact to teaching; would lead to individual students raising concerns; no impact on NSS scores minor disruption to teaching; would lead to a group of students raising concerns; low impact (1-2) years on NSS scores significant disruption to teaching; would lead to individual students raising a formal complaint or leaving the University; medium impact (2-3 years) on NSS scores teaching stopped in one or more School; would lead to a group of students raising formal complaints or leaving the University; long term impact (more than 3 years) on NSS scores
Student Recruitment no noticeable impact on student recruitment would lead to 1% and 3% of student recruitment markets not being met would lead to 4% to 7% of student recruitment targets not being met would lead to between 7% and 10% of student recruitment targets not being met would lead to more than 10% of student recruitment targets not being met
Sustainability Overall success in meeting targets and fulfilling actions; a small number of actions not achieved within expected timescale Overall success in meeting targets and fulfilling actions; some targets missed and some actions not achieved within expected timescale Mixed success in meeting targets and fulfilling actions; significant revision required to strategy and action plan Some successes in implementing sustainability strategy but overall failure to achieve goals, resulting in negative publicity General failure to achieve strategy resulting in widespread condemnation and reputational damage to University
Technology/ IT Negligible impact on technology systems, infrastructure or architecture MInor impact on technology systems, infrastructure or architecture with a known solution or a medium term workaround fix.  There may be an impact on the delivery of the Technology Strategy Impact to technology systems, infrastructure or architecture that could be fixed with a short term workaround solution.  Minimal impact on the delivery of the Technology Strategy Major impact on technology systems, infrastructure or architecture that would require immediate remediation.  Key elements of the Technology Strategy would not be delivered. Untenable impact on technology systems, infrastructure or architecture.  Unable to achieve the delivery of the Technology Strategy
Opportunities would result in minor improvements to technology systems, infrastructure or architecture Opportunities would result in significant improvements to technology systems, infrastructure or architecture Opportunities would result in significant improvements to technology systems, infrastructure or architecture Opportunities would result in a transformational change to technology systems, infrastructure or architecture
Transformation Minor impact on the Transformation Strategy Would result in a delay or increase to cost within business case tolerances to a Transformation project.  Would result in a delay or increase to cost outside of business case tolerances but highly likely to be approved.  May result in minor inefficiencies to our processes or systems Would result in a significant delay or increase to cost to a Transformation project.  May result in major inefficiencies to our processes or systems. Would result in the complete halt to a Transformation project.  The Transformation Strategy would not be able to meet stated goals.  Would result in unacceptable inefficiencies to our processes or systems
Opportunities would have some impact to the Transformation Strategy. Would result in minor efficiency improvements to our processes or systems Opportunities would have a direct impact to the Transformation Strategy.   Opportunities would exceed the current expected benefits from the Transformation Strategy.  Would result in significant efficiency improvements to our processes or systems
PROJECT SPECIFIC RISKS
Project – Finance and cost Overspend of less than 1% of agreed budget  Overspend between 1% and 3% of agreed budget  Overspend between 3% and 5% of agreed budget; minor changes to current procurement or current supplier contracts required Overspend between 5% and 10% of agreed budget; major changes to current procurement or current supplier contracts required.  Additional Capital Application required Overspend of greater than 10% of agreed budget; new procurement or new supplier contracts will be required.  Additional Capital Application required
Project - Resources We have the capability but there may be an acceptable delay in freeing the resources to complete the work We have the capability but there may be an unacceptable delay in freeing the resources to complete the work We do not have the capability and would need to train current resources to complete the work within acceptable cost or time We do not have the capability and would need to source externally or recruit to complete the work within acceptable cost or time We not have the capability and sourcing expertise is likely to be increase cost or time to unacceptable levels
Project – Scope and business case Scope change or functionality/quality/ business case impact barely noticeable.   Scope change or functionality/quality/business case impact noticeable but accepted by customer/end user Scope change or functionality/quality/ business case noticeable and would require a minor change Scope change or functionality/quality/business case noticeable and would require a major change Scope change or functionality/quality/business case would not be accepted by the customer/end user
Project – Time and planning Slippage of less than 2% of project lifecycle or less than 4 weeks.  Has no impact of the implementation of business activities. Slippage between 3% and 10% of project lifecycle or between 1- and 2-months slippage.  Delay of up to two weeks for non-business critical activities and up to 2 days on business-critical activities. Slippage between 10% and 15% of project lifecycle or between 2- and 3-months slippage.  Delay of up to 4 weeks for non-business critical and up to 1-week delay to business-critical activities. Slippage between 15% and 20% of project lifecycle or between 3- and 6-months slippage.  Delay of up to 2 weeks for business-critical activities. Slippage of greater than 20% of project lifecycle or more than 6 months slippage
Delay of greater than 2 weeks for business-critical activities.

Risk register template in Microsoft Excel

Please note that there are some ongoing refinements to our risk appetite and impact statements that will be updated here in Q3 2022

Download a blank Excel risk register template

Last updated June 2022

Risk register template in SharePoint

We are developing guidance and a template that allows you to create a risk register within your Teams site.  This is expected in Q3 2022 alongside our online training course.

In the meantime, if you would like to create a risk register within your Teams site, please contact craig.chapman-smith@glasgow.ac.uk who can help set this up.

Updated May 2022