Skip to main content
MethodLegal, Risk & ComplianceRisk managementIntermediate

Build an enterprise risk register

A company-level risk register with categories, scores, owners, controls and appetite.

This is a practical, copy-paste process for board risk reviews.. Use it when you want a clear structure, then add your own details and the linked evidence.

Published by Deepstory Research. Reviewed Sep 2026.

How to use this method

  1. 1. Copy or downloadCopy the prompt below, or download the method file and attach it to your chat.
  2. 2. Paste into any AIChatGPT, Claude, Gemini or Copilot. Replace each [PLACEHOLDER] with your details, or let the AI ask you.
  3. 3. Add evidenceAttach the evidence files listed on this page so the AI works from sourced numbers, not guesses.

The prompt

Paste it as-is. The AI will ask for anything still in [BRACKETS].

Download .md
# Build an enterprise risk register
Method by Deepstory Research: deepstoryresearch.com/method/business-risk-register

You are a chief risk officer. Follow the method below step by step. Goal: A company-level risk register with categories, scores, owners, controls and appetite.

## My inputs
- Business: [BUSINESS]  (example: describe)
- Key concerns: [KEY_CONCERNS]  (example: list)
- Risk appetite: [RISK_APPETITE]  (example: low for compliance, medium for growth)

Before you start: if any input above is still in [BRACKETS] or missing, ask me for it in one short numbered list and wait. Do not guess. If I attached files (data, briefs, Deepstory evidence files), treat them as the primary source.

## Steps to follow
1. Identify strategic, operational, financial, compliance and external risks.
2. Score inherent risk.
3. List existing controls and residual risk.
4. Assign owners and treatment plans.
5. Define KRIs.

## Deliver the output in this structure
- Risk register
- Heat map
- Treatment plans
- KRIs

## Quality rules
- Each risk has one owner.
- Label every number as FACT (with source and date), ESTIMATE (show the calculation) or ASSUMPTION.
- If a Deepstory evidence file is attached, use its figures as the reference values and cite its source references; tag claims that are not from it as [UNVERIFIED].
- End with: the 3 assumptions that matter most, what would change the answer, and the single best next step.

What you need to give the AI

InputPlaceholderExample
Business[BUSINESS]describe
Key concerns[KEY_CONCERNS]list
Risk appetite[RISK_APPETITE]low for compliance, medium for growth

Use it when

  • Board risk reviews.
  • Insurance and investor diligence.

What you get

  • Risk register
  • Heat map
  • Treatment plans
  • KRIs

The procedure, step by step

Read this before you run it, so you can check the AI actually followed the method.

  1. 1

    Identify strategic, operational, financial, compliance and external risks.

  2. 2

    Score inherent risk.

  3. 3

    List existing controls and residual risk.

  4. 4

    Assign owners and treatment plans.

  5. 5

    Define KRIs.

Quality checks built into the prompt

  • • Each risk has one owner.
  • • Every number labelled FACT, ESTIMATE or ASSUMPTION; claims outside attached evidence tagged [UNVERIFIED].

Evidence to use with this method

Methods tell the AI how to think. Evidence gives it sourced numbers to think with. Download a context file and attach it with the prompt.

Run next

Methods that chain well after this one.

Business Strategy & PlanningPlan for uncertainty with scenariosFour plausible future scenarios built from two critical uncertainties, with signposts and no-regret moves.

Deepstory methods are process guidance for AI tools. Review AI output before relying on it; legal, tax, medical and investment decisions need a qualified professional.