Identify risk event

Order	Tab	What you do in real life	LondonBuild example
1	Start with the Control	Look at the control you have mapped.	Quarterly user-access review
2	Identify the Asset	Determine what needs protection.	Microsoft 365, project files, HR data
3	Identify the Threat	Ask what could cause harm.	Former employee, attacker, malicious insider
4	Identify the Vulnerability	Ask what weakness could be exploited.	Leaver’s account remains active
5	Identify the Risk Event	Describe the actual event that could happen.	A former employee uses an active account to access confidential project information.
6	Identify the Cause	Explain why the event could occur.	IT is not notified immediately when employees leave.
7	Identify the Impact	Determine what happens if the event occurs.	Data exposure, financial loss, contractual issues, reputational damage.
8	Identify Affected Assets/Data	Record what could be affected.	Client drawings, contracts, employee information
9	Record the Risk Event	Put the event into the risk register.	Unauthorised access to sensitive information following employee termination.
10	Link to Requirement/Control	Connect the risk back to your GRC work.	ISO 27001 A.5.18 → AC-003 → Risk R-001

The actual LondonBuild risk

You could document it like this:

Field	Example
Risk ID	R-001
Risk Event	Former employee accesses company information using an active account.
Threat	Former employee / external attacker
Vulnerability	Account not disabled promptly
Asset	Microsoft 365 / project information
Cause	Poor HR-to-IT offboarding process
Impact	Data breach, financial loss, reputational damage
Related Requirement	ISO 27001 A.5.18
Related Control	AC-003 — Leaver account termination
Risk Owner	IT Manager

Risk Register — Google Sheets

For LondonBuild, your Google Sheet could look like this:

Risk ID	Risk Event	Cause	Threat	Asset	Impact	Likelihood	Risk Score	Risk Level	Risk Owner	Treatment	Status
R-001	Former employee accesses confidential information using an active account	Poor offboarding	Former employee	Project files	Data breach	3	12	High	IT Manager	Improve offboarding	Open
R-002	Employee accidentally sends confidential client information to wrong recipient	Lack of verification	Human error	Client data	Data exposure	3	9	Medium	Data Protection Officer	Email controls/training	Open
R-003	Ransomware encrypts project files	Weak endpoint protection	Cybercriminal	Project files	Operational disruption	4	16	High	IT Manager	Strengthen EDR/backups	Open

Where it fits in your GRC process

Identify Risk Event

⬇️

Create / update Risk Register

⬇️

Assess Risk

• Likelihood
• Impact
• Inherent Risk
• Existing Controls
• Residual Risk

⬇️

Risk Treatment

• Mitigate
• Accept
• Transfer
• Avoid

⬇️

Track & Monitor

⬇️

Report

So, if you’re building your GRC portfolio

I would actually create a Google Sheets Risk Register as one of your practical deliverables.

Your tabs could be:

1. Risk Register
2. Risk Scoring
3. Risk Matrix
4. Risk Treatment
5. Risk Actions
6. Risk Dashboard

That would make your learning project much closer to what you’d actually do as a GRC Analyst.