The register is the artefact
What a board or an examiner asks for is not a score. It is the register: every risk, its controls, its owner, its rating, and the date it was last reviewed.
Governance
Fraud
Security
Financial crime
| Risk | Domain | Controls | Residual |
|---|---|---|---|
| Third-party onboarding without EDD | Financial crime | Partial | High |
| Unreviewed privileged access | Security | Met | Medium |
| Board reporting cadence | Governance | Met | Low |
A register you can defend.
Most businesses have a spreadsheet. The difference shows when somebody asks why.