The risk you didn't write down

Most risk registers are written by people imagining what could plausibly go wrong. The problem is the things that actually go wrong are often the ones nobody thought to write down.

Earlier this year, a CRM platform used by well over a thousand UK charities was breached. Attackers got in using compromised login credentials rather than anything technically sophisticated, and copied the underlying database backups. The charities themselves hadn't done anything wrong. They'd simply trusted a well-regarded supplier to hold their donor and supporter data safely -

which is exactly what most organisations do, every day, without a second thought.

That's the uncomfortable part. A supplier risk like that rarely makes it onto a register, because it doesn't feel like "your" risk. It's not your system, your staff, your decision. But the data was still yours to protect, and the fallout - the obligation to review what was affected, notify people, and report to the regulator - still landed on the charities, not the software company.

A good risk register isn't a list of the obvious things. It's a discipline of asking "who else's failure becomes our problem" - suppliers, contractors, systems you don't control but still depend on. Most organisations, charity or commercial, don't ask that question until after the answer has already cost them something.