Risk statement
- Describe cause, event and impact
- Score likelihood and consequence
- Record current controls and residual exposure
GitHub Actions Academy · governance guide
Technical Risk Register
Turn vague concern into owned, measurable and time-bound risk treatment.
Enterprise control patternEvidence-led review
Treatment plan
- Choose avoid, reduce, transfer or accept
- Assign owner and target date
- Define measurable completion evidence
Review discipline
- Track movement in risk score
- Escalate overdue critical actions
- Close only when evidence exists
Completion evidence
Produce a reviewed artefact for GitHub Actions Academy: named owner, approval date, linked evidence, unresolved risks and the next review trigger.