Stress-test a risk register before the board, auditors, or operators treat a colorful grid as coverage when owners, scores, and triggers are still fiction.
Risk registers fail when every item is "medium," when owners are roles instead of named people with calendars, when residual risk after controls is never measured, and when the loudest risks are the ones with easy slides rather than the ones that can stop the company. A tidy spreadsheet is not evidence that the register survives a bad quarter.
What to put on the table
One sentence for the decision the register is supposed to support, the time horizon, and the success metric for "we are actually managing risk." Attach the current register, the last incident or near-miss log, control owners, and the escalation path when a score rises. If risk, ops, and finance disagree on severity math, reconcile before the stress test.
Name the decision you will make if the stress test finds nothing new, and the delay criteria if material risks lack owners or triggers.
Attack surfaces
- Ownership honesty: which rows have a real human with a next review date.
- Score integrity: whether likelihood and impact use shared definitions or vibes.
- Control evidence: which mitigations have a test date versus a hopeful label.
- Silent dependencies: vendors, single points of failure, and regulatory clocks.
- Board and audit read: the question a careful director would ask first.
Optional counsel seat if regulated claims bind wording. Optional customer seat if product risks show up first as churn.
How to run it
Feed Pingpong the register, incident log excerpts, and control evidence. Early passes steelman the top risks. Later passes attack from ops, finance, counsel, and skeptic seats. End with a pass that turns surviving objections into owner assignments, harder scores, or risks that should leave the "accepted" column. Delete dual-counted mitigations and invented residual-risk math.
When the register lists residual risk as "low" after a control that has never been tested, force ops and finance seats to price a failed-control month in writing. Ask what cash, customers, or regulators feel first if the control is theater. Residual risk that only appears as a green cell still counts.
Ask the skeptic seat to compare the top five risks to the last twelve months of incidents and near misses. If the loudest historical failures are missing or scored soft, rewrite the register before the board pack ships. Treat "accepted" as a decision with an owner and a revisit date, not as a polite way to ignore the row.
Force a quarter-after narrative: what fails if two high risks fire in the same month, and whether the register still tells operators what to do first. If that story is stronger than your top-five list, fix the package before the next board pack. Related: war-game a board deck, stress-test a security incident response, CEO decision review, pretend you are the board skeptic, and the war-game decisions hub. Process: how to run a Pingpong.