We keep a structured register of the risks in our business. Every risk is rated for severity and probability, matched with controls, and reviewed every year by the Director.
The register covers every area of the business:
Each entry records the risk, its rating, the controls in place and the residual risk after those controls. Anything that scores high gets an action plan with an owner and a review date. Anyone may raise a concern about any of these areas through our grievance mechanism.