Weekly risk review — High and Critical risks only

Cadence: every Monday, 30 minutes. Owner: project manager.

Sort the Table view by Risk Score, descending. Work down from the top and stop at Medium. You are not reading the whole register.

Three questions per risk:

1. Has the score changed since last week? If so, why, and does the Risk Level need updating?
2. Is the mitigation actually moving, or has it been "in progress" for three weeks?
3. Has the trigger fired?

Close the meeting by deciding: what gets escalated, what gets closed, what is newly identified.

A review that ends with no field changed anywhere on the register is a review that did not happen.