Make risk judgments you can explain
Connect business impact, current safeguards and treatment decisions.
Content and source check: October 1, 2026 · Operational suggestions
Scope the assessment
Choose the period and systems, services and information covered. Annual is a planning option; reassess after material changes when appropriate.
Tailor the scenarios
The starting scenarios are prompts, not a complete risk universe. Add, remove or rewrite them for your firm and link affected inventory items.
Explain each judgment
Set likelihood and impact definitions before rating. Record current safeguards and evidence, then separately explain residual risk. Planned improvements do not reduce current risk until implemented and evaluated.
Choose treatment
Document why you will accept, mitigate, avoid or transfer each risk. Record the acceptance authority or follow-up owner and date. Transferring financial impact does not remove all operational or legal responsibilities.
Source & applicability
NIST-30 — SP 800-30 Rev. 1: Guide for Conducting Risk Assessments
Risk assessment context, likelihood, impact and uncertainty inform the worksheet. Its qualitative labels and seed scenarios are product-authored. Federal risk guidance adapted as a voluntary planning aid. An annual cadence is a user choice, not a universal Reg S-P requirement.
SEC-registered and state-registered firms may have different obligations. Have the appropriate professionals review what applies to your firm. No regulatory determination is made here.