Risk Management
Enterprise Risk Register Heatmap
Likelihood-by-impact distribution of all registered risks, surfacing where exposure concentrates.
Why the heatmap drives risk decisions
A risk register only earns its keep when it shows leadership where exposure concentrates, and plotting every registered risk by likelihood and impact is the technique King IV and the public-sector risk-management frameworks rely on to prioritise scarce mitigation effort. Without that view, registers become long lists that treat trivial and catastrophic risks alike. AuditPro Core renders the full register as a likelihood-by-impact heatmap so the accounting officer and risk committee can see, at a glance, where the organisation's real exposure sits.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Open risks
184
High / extreme
37
20% of register
Within appetite
121
66% of register
Overdue reviews
14
past review date
Risks by severity band
Severity bands by likelihood and impact
| Band | Avg likelihood | Avg impact | Risks |
|---|---|---|---|
| Low | 1.4 | 1.6 | 58 |
| Moderate | 2.6 | 2.5 | 63 |
| High | 3.7 | 3.6 | 26 |
| Extreme | 4.6 | 4.5 | 11 |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
Likelihood and impact
Risk is the product of how probable an event is and how damaging it would be. Scoring both dimensions and plotting them together separates the high-impact, high-likelihood risks from the noise.
Inherent versus residual
Inherent risk is the exposure before controls; residual risk is what remains after them. The heatmap is most useful on residual risk, because that is what the organisation actually carries.
Concentration over volume
A heatmap reveals clustering in the top-right quadrant, where the most serious risks gather. Concentration there matters far more than the total count of risks on the register.
Appetite and tolerance
Overlaying the board's risk appetite shows which risks breach tolerance and demand action. The heatmap turns an abstract appetite statement into a concrete line on the grid.
How AuditPro Core Bridges the Gap
- Exposure visualisation: plots every registered risk by residual likelihood and impact to show where exposure concentrates.
- Continuous monitoring: updates the heatmap as risk scores and controls change so the picture stays current.
- Exception workflow: risks breaching appetite are escalated to the risk committee with an owner and action.
- Traceability to source: links each plotted risk to its register entry, controls and assurance status.
Key Takeaways
- Plot likelihood against impact to prioritise, not just list, risks.
- Use residual risk, since that is what the organisation actually carries.
- Watch concentration in the top-right quadrant over total count.
- Overlay appetite to see which risks breach tolerance and need action.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.