Open most risk registers and you'll find something like this near the top:
• Staffing
• IT
• CQC inspection
• Finance
These aren't risks. They're topics. A board can nod at "Staffing" for years without ever being clear about what might actually go wrong, what's causing it, or what it would mean for patients. And because the risk is vague, the controls listed against it tend to be vague too: "recruitment ongoing", "monitored by management".
A well-written risk does three jobs at once. It tells you why the risk exists, what could happen, and what the impact would be. Get those three right and the conversation about controls, owners and scores almost writes itself.
The fix: cause, event, consequence
Rewrite each risk using one simple sentence:
Because of [the cause], there is a risk that [the event], leading to [the consequence].
That's it. Here's how it changes things.
Before: Staffing
After: Because of reliance on agency nurses for night shifts, there is a risk that staff unfamiliar with our patients and procedures miss early signs of deterioration, leading to avoidable harm and a breach of Regulation 12.
Before: IT
After: Because our patient booking system is provided by a single small supplier with no tested exit plan, there is a risk that the system becomes unavailable without warning, leading to cancelled appointments, delayed care and loss of patient records access.
Before: CQC inspection
After: Because our audit programme checks that policies exist rather than whether they're followed, there is a risk that gaps in practice go undetected until inspection, leading to a lower rating and loss of commissioner confidence.
Notice what happens. Each rewritten risk points straight at what you'd need to control. The agency risk calls for induction and handover checks. The supplier risk calls for an exit plan and data ownership. The audit risk calls for a different kind of audit. "Staffing" and "IT" pointed at nothing.
A few tips
• Keep the cause specific to you. "Because of national workforce shortages" is true, but it isn't yours to fix. "Because of our reliance on agency staff at night" is.
• Make the event something that could genuinely happen. If it's already happening, it isn't a risk any more. It's an issue, and it belongs on a different list with an action plan.
• Put patients in the consequence where they belong. Financial and reputational impacts matter, but in healthcare the first question is usually what it means for the people in your care.
• One risk, one sentence. If you find yourself writing "and" twice in the event, you probably have two risks.
Your ten minutes
1. Open your risk register and find your top three risks by score.
2. Rewrite each one using "Because of… there is a risk that… leading to…".
3. Read the controls listed against each one. Do they still match the risk as you've now described it?
4. Take the rewritten versions to your next governance meeting and ask: does this change how we score it, or who owns it?
You may find that one of your "top three" wasn't really a top risk at all once you could see it clearly. That's the point.
The governance bit
Boards don't need longer risk registers. They need ones they can understand at a glance and challenge with confidence. A clearly worded risk is the difference between a board that notes the register and a board that asks, "What would tell us this is getting worse?"
Ten minutes. Three sentences. A much better conversation.
