Risk registers are good at recording what is already agreed to be a risk. Currency, supply, cyber, key-person — the familiar categories, each with an owner, a score and a mitigation. They are considerably worse at capturing the thing a plant manager has believed for two years but has never had a route to say.

Registers filter for legitimacy

To reach a register, a risk must first be phrased in the register’s language, then accepted by someone senior enough to sponsor it, then scored in a way that survives comparison with everything else on the list. Each of those steps removes real risks. What clears all three tends to be the risks that are already managed.

The consequence is a document that reads as comprehensive and is systematically blind to anything culturally awkward: a relationship with a single customer nobody wants to name, a process that only works because one person stays late, a control that has been failing quietly since a system migration.

Ask the question that has no owner

The most productive question in a risk review is not what keeps you awake. It is: what would you fix tomorrow if it were entirely your decision and nobody would take it personally. The answers are specific, they come quickly, and they very rarely appear on the register.

Ask it two levels below the executive team. The people who operate the process know where it bends. They are usually not asked, because the register is owned by the people who designed it.

Score consequence before likelihood

Likelihood is where estimates go to become negotiable. Anyone can argue a probability down, and in practice they do, because a lower score means less scrutiny. Consequence is harder to argue with — the plant either stops or it does not.

Start there. Sort the list by what happens if it occurs, then work backwards. The order that produces is usually not the order the register had, and it is a considerably better guide to where attention should go.