Every framework. One platform. One price.

Risk Posture Summary

The organisation currently holds 39 active risks, with a heavy concentration at the top end of severity: 11 critical and 25 high risks account for 92% of the total register, and there are no low-rated risks providing balance. While all risk reviews are technically up to date, the underlying treatment and control data tell a more concerning story — treatment completion stands at just 5.4% and average control effectiveness is 3.2%. This is a risk register that is well-catalogued but poorly mitigated.

Key Concerns

RISK-2026-0042 shows no risk reduction at all — inherent and residual scores are identical (16/16) — and it also appears in the coverage gap list with no linked treatment.

RISK-2026-0041 (Ransomware), rated critical, has no linked treatment. Given the severity classification and the threat landscape, this is one of the most exposed items on the register.

11 of 56 treatments (nearly 20%) are overdue, indicating the mitigation pipeline is stalling rather than progressing.

Alex Cooper owns four of the top ten residual risks (RISK-2026-0006, 0010, 0014, 0035) — a significant concentration of high-severity ownership in one individual.

Coverage Gaps

Eight risks currently have no linked treatment, including two critical risks (RISK-2026-0041 Ransomware, RISK-2026-0014 Working Capital) and six high risks. This means roughly a fifth of the active register has no documented mitigation pathway at all.

Control effectiveness data reveals six named weak controls (<50% effectiveness), spanning AI/technical security, DLP and monitoring, working capital financing and vendor concentration — a spread across cyber, financial and strategic domains rather than one isolated area.

Positive Developments

Risk reviews are fully current with zero overdue — the review discipline and governance cadence is being maintained, which is the foundation everything else can be built on.

Three treatments have been completed, and several critical risks (RISK-2026-0020, 0021, 0035) show substantial inherent-to-residual score reduction (20 → 6), indicating that where treatments have been applied, they are demonstrably effective.

No critical or high audit findings are currently open. Combined with the weak control and low-treatment-completion picture, however, this raises the question of whether audit coverage has been comprehensive enough to surface these issues.

Recommended Actions

Link treatments to the eight uncovered risks — starting with the two critical items, which represent the clearest single gap between the register as documented and the risk actually being managed.

Investigate the 3.2% control effectiveness figure before acting on it. A number this low across the whole estate usually indicates a measurement or evidence-capture problem rather than genuine near-total control failure; either interpretation warrants immediate clarification from the control owners.

Redistribute concentrated ownership. Four of the top ten residual risks sitting with one owner is a key-person dependency in its own right, and it slows the treatment pipeline that is already stalling.

Clear the overdue treatment backlog — 11 of 56 overdue is the leading indicator that mitigation is falling behind identification, and it will compound quarter on quarter if left.