A Register Full of Reassurance
Open almost any housing provider's risk register and you'll find the same pattern. A risk, a score, and a column headed "controls" filled with phrases like annual inspection programme, policy in place, monitored by committee.
It reads as reassuring. That's the problem.
A list of controls tells you what the organisation intends to do about a risk. It doesn't tell you how much those controls reduce the risk, whether they're actually operating, or whether anyone has checked. And when a regulator or a board member asks the obvious follow-up question, "how do you know that control works?", the register usually has no answer. Someone has to go and find one.
That gap, between the controls you list and the assurance you can evidence, is where most risk registers quietly fail.
Inherent, Residual, Target: Why Three Scores Matter
A single risk score is a snapshot with no context. It tells you where a risk sits, but not why, and not whether your efforts are making any difference.
Three scores tell a much more useful story.
Inherent risk is the position before any controls: how likely and how damaging the risk would be if you did nothing. It's the honest starting point, and it's the score that reminds everyone why the risk matters.
Residual risk is where you are now, with controls in place. The difference between inherent and residual is the value your controls are delivering. If that difference is small, your controls aren't doing much, however long the list.
Target risk is where you're trying to get to, based on your risk appetite. The gap between residual and target is the work still to do, and it's the gap that should drive your actions.
With all three in place, a conversation about risk changes. Instead of debating whether a score of 12 "feels right," the board can ask sharper questions. Which controls are carrying the most weight? Where is the residual position still outside appetite? What actions are closing that gap, and are they on track?
Controls Are Claims. Assurance Is Evidence.
This is the distinction most registers miss.
A control is something you do to reduce a risk: a gas servicing programme, a fire door inspection regime, a damp and mould triage process, a complaints escalation procedure.
An assurance is the evidence that the control is actually working: the servicing compliance rate, the inspection completion figures, an internal audit finding, a spot-check result, a board report.
Without assurance, a control is a claim. And claims are exactly what inspectors test.
The housing sector has learned this the hard way. Providers have reported fire safety as "controlled" on the strength of an inspection programme that was months behind. Damp and mould has been recorded as mitigated by a policy that frontline teams weren't consistently applying. The risk register said one thing; the operational reality said another.
A register that records assurances alongside each control makes that disconnect visible, early, while there's still time to act on it.
Why Housing Can't Afford a Static Register
In many sectors, strategic risk and day-to-day operations sit some distance apart. In social housing, they don't.
The risks that dominate housing board agendas, building safety, damp and mould, stock condition, complaint handling and cyber security among them, are directly shaped by what happens at property level every day. A slipping inspection programme, a backlog of repairs or a rising complaint theme changes the true risk position immediately, not at the next quarterly review.
That has three practical consequences:
- Reviews need a rhythm, not a ritual. Each risk should have its own review frequency based on how volatile it is, with reviewer comments captured each cycle so there's a history of how thinking has changed.
- Actions need owners and dates. A gap between residual and target is only useful if it becomes a specific action, assigned to a named person, tracked against the risk it belongs to.
- Risks need a line of sight to regulation. Many housing risks exist because of a specific regulatory requirement. Linking the two means that when a requirement changes, the affected risks are obvious.
A static register can record none of this well. A living one records it by default.
Different Registers, One Picture
Most providers don't have one risk register. They have a corporate register for the board, operational registers for directorates, and often project or team-level registers too.
The challenge is keeping those registers separate enough to be useful to their owners, but consistent enough to give leadership a coherent picture. That means shared scoring scales and thresholds, consistent categories across strategic, operational, financial, legal, cyber, reputational and other areas, and the ability to report across registers rather than within them.
When categorisation is consistent, concentration becomes visible. You can see, for example, that building safety appears as a significant residual risk in three separate operational registers, even though the corporate register treats it as well controlled. That kind of insight is almost impossible to spot across disconnected spreadsheets.
What the Board Should Be Able to See
For boards, the purpose of a risk register is assurance. At any point in the year, not just the week before a meeting, a board should be able to see:
- Which risks sit outside appetite on a residual basis
- Which controls have current evidence behind them, and which don't
- Which actions are overdue, and against which risks
- Which risks have moved since the last review, and why
If producing that picture requires someone to spend days assembling a board pack, the register is a reporting burden rather than a management tool.
A Pragmatic Place to Start
You don't need to rebuild your register from scratch to close the assurance gap:
- Score inherent and residual separately for your top ten strategic risks. If the two scores are identical, ask what the controls are really doing.
- Attach one piece of assurance to every key control. If you can't find one, that's a finding in itself.
- Set target scores based on your appetite, and turn every gap into an owned, dated action.
- Set review frequencies per risk, not one quarterly cycle for everything.
- Standardise categories and scoring across every register you run.
The organisations that handle scrutiny well aren't the ones with the most detailed registers. They're the ones that can show, on any given day, what their controls are worth and the evidence that proves it.
Wavio is a unified digital-first platform empowering housing providers and local authorities with integrated governance, compliance, and operational management tools. Find out more about Wavio Risk Register, or book a demo to see how risk registers, legal registers and policy management connect in one platform.