A legal-risk score without an obligation, event, owner, and evidence is decoration. Startups need a register that connects what the company does to the law, contract, license, or corporate approval that governs it. The register must change when the company hires, ships, raises, enters a country, collects new data, or receives a complaint.
Inventory activities before risks
Map entities, operating countries, workers, customers, regulated products, payment flows, data categories, vendors, intellectual property, financing instruments, and licenses. Then attach each activity to a governing law, contract, permit, policy, or corporate approval. This prevents generic risk labels from hiding the actual obligation.
The six domains in this page are a navigation aid, not a complete legal taxonomy. A health product, financial service, marketplace, exporter, or child-facing app requires additional sector and jurisdiction branches.
Use a decision-grade risk register
The useful artifact is one register with activity, obligation, source and effective date, jurisdiction, triggering event, affected right, likelihood rationale, impact rationale, existing control, evidence, owner, next action, deadline, residual risk, and approver. Keep uncertainty in words rather than hiding it behind a precise-looking number.
If the team uses a score, define what each level does. In the labeled example here: monitor, mitigate, obtain counsel review, or pause for an accountable stop decision. The levels are internal routing choices, not an official risk formula or benchmark.
- Monitor3 count
- Mitigate5 count
- Counsel review7 count
- Stop decision8 count
ISO 31000 risk management (2026-08). Example mandatory fields by escalation level, not incident statistics.
Test whether controls work
The DOJ compliance-program guidance asks whether a program is well designed, applied earnestly and in good faith, and works in practice. Translate that into evidence: sample approvals, access logs, completed training, complaint handling, contract exceptions, filing receipts, and remediation closure.
A policy is not a control until a test can fail. Name the tester, sample, expected result, failure path, and retest date. Preserve bad results and remediation; deleting them destroys the learning and may destroy evidence.
Trigger specialist assessments
A new high-risk data use may require a DPIA under applicable data-protection law; a cyber change needs security analysis; a financing needs corporate and securities review; a new worker location needs labor, tax, and benefits review. The central register routes these assessments but does not replace them.
Escalate when facts are disputed, rights may be materially affected, regulators or litigation are involved, privilege matters, or the company cannot describe a lawful path. Preserve documents under counsel direction when a dispute or investigation is reasonably anticipated.
Jurisdiction and effective-date boundary
Sources were reviewed on 21 August 2026; NIST CSF 2.0 dates to 2024. ISO guidance, DOJ expectations, privacy rules, sector law, sanctions, licensing, and filing duties serve different systems and change on different schedules.
This framework is not legal advice and does not determine privilege, liability, legality, or required filings. Qualified counsel in each relevant jurisdiction and specialty must assess the company’s facts.
Frequently asked questions
What is the first legal-risk assessment step?
Inventory actual activities and connect each one to a source of obligation.
Should every risk receive a numeric score?
No. Clear rationale and an assigned decision are more useful than false precision.
When should counsel be involved?
When rights, material liability, disputed facts, regulators, litigation, privilege, or unclear law are involved.
Is a policy proof of compliance?
No. Test design, operation, failures, remediation, and dated evidence.
Answers to the questions this topic usually leaves hanging.
How we sourced this
Every statistic in Legal Risk Is a Decision Queue, Not a Red Heatmap is attributed. Where a number is an estimate rather than a census, the note says so.
- ISO 31000 risk managementPrinciples and process for organizational risk management.
- DOJ compliance-program evaluationOfficial questions about design, implementation, and practical effectiveness.
- NIST Cybersecurity Framework 2.0Cybersecurity risk lifecycle for the cyber domain.
- ICO DPIA guidanceOfficial trigger and process guidance for UK data-protection impact assessments.
Primary sources used for this edition.
The bottom line
If a risk row cannot name the obligation, evidence, owner, and next decision, it is not yet manageable.
If you want the adjacent decisions after Legal Risk Is a Decision Queue, Not a Red Heatmap, start with Legal budget, Legal documentation, Legal technology, Legal structure.
