A risk register for a corporate Bitcoin treasury is a structured log of what could go wrong, how likely and severe each risk is, which controls reduce it, and who owns it. A good one scores risks both before and after controls and links each to an indicator that warns when things are changing. This article covers how to build and run the register; for a description of the risks themselves, see the main risks of a corporate Bitcoin treasury.
What a risk register does for a corporate Bitcoin treasury
Most companies already keep an enterprise risk register. A Bitcoin register is usually a sub-register that feeds into it. It does three jobs:
- It shows the board what is being managed. Directors see each risk, its rating and the control in one place.
- It assigns accountability. Every risk has a named owner.
- It records change over time. When a rating moves, the register shows when and why.
A register that is filled in once and filed is not doing its job. It should be read, challenged and updated.
The columns to include
Use the same format as your enterprise register where possible, so ratings are comparable. A practical set of fields:
- Risk ID and title. Short and specific, such as "Loss of signing quorum".
- Description. Cause, event and consequence in one or two sentences.
- Category. Market, liquidity, custody, counterparty, operational, technology, compliance, accounting, regulatory, reputational.
- Inherent rating. Likelihood and impact with no controls in place.
- Controls. Each control, with a reference to the policy clause or procedure.
- Residual rating. Likelihood and impact with controls operating.
- Key risk indicator (KRI). A measurable signal, with a threshold.
- Owner. One person, by role.
- Action plan. Any open improvement, with a date.
- Last reviewed. Date and reviewer.
Scoring: inherent and residual risk
Pick a simple scale and apply it consistently. A five-point scale for likelihood and impact is common, with the product giving a score out of 25.
Define the impact scale in your own terms. For example, impact 5 might mean a loss above a set percentage of net assets, or an event requiring disclosure to the market. Without definitions, two people will score the same risk differently.
The gap between inherent and residual scores shows how much each control is doing. A risk with a high inherent score and a low residual score depends heavily on its controls, so those controls deserve regular testing.
The table below shows how a few entries might look. All ratings are illustrative and every company should assess its own.
| Risk | Inherent (L x I) | Key controls | Residual (L x I) | KRI and threshold |
|---|---|---|---|---|
| Loss of signing quorum | 3 x 5 = 15 | Distributed signers, documented recovery, annual test | 1 x 5 = 5 | Days since last recovery test > 365 |
| Payment to wrong address | 3 x 4 = 12 | Whitelists, test transfer, out-of-band verification | 1 x 4 = 4 | Any non-whitelisted transfer attempt |
| Provider failure while pre-funded | 2 x 5 = 10 | Exposure caps, short settlement windows | 1 x 3 = 3 | Pre-funded balance above cap |
| Cash floor breached in a drawdown | 3 x 4 = 12 | Cash floor in policy, sizing method | 1 x 4 = 4 | Months of cash cover below floor + 3 |
| Received funds linked to sanctioned party | 2 x 4 = 8 | Address screening, licensed providers only | 1 x 4 = 4 | Any high-risk screening alert |
Notice that impact often stays the same after controls. Most Bitcoin controls reduce likelihood, not severity, because a lost or misdirected transfer is usually final.
When the residual score barely moves from the inherent score, ask whether the listed control is really a control or just a description of good intentions.
Risks first-time registers often miss
Registers built from a generic template tend to cover price and custody well and miss the practical ones. Consider adding:
- Key person dependency. Only one person understands the process.
- Provider change of control. A custodian is acquired and its terms change.
- Pricing source failure. The valuation source used for month end is unavailable or disputed.
- Banking friction. A bank restricts payments to or from digital asset providers.
- Phishing and impersonation. A fake instruction appears to come from a signer or provider. See cybersecurity for finance teams.
- Policy drift. Practice diverges from the written policy over time.
- Rule changes. New rules affect a provider's ability to serve the company. See Bitcoin regulation for corporates.
Key risk indicators
KRIs turn the register into an early-warning tool. A good KRI is measurable from data you already hold, has a clear threshold, and is reported without anyone needing to interpret it.
Examples:
- headroom against each concentration limit;
- months of operating costs covered by cash;
- largest single-provider exposure;
- number of unreconciled differences at month end;
- days since the last access review of signers;
- number of policy exceptions open.
Many of these also appear in board reporting. Our article on Bitcoin treasury reporting KPIs shows how to present them.
Running the register
Ownership. Each risk has one owner who updates its rating and controls. The CFO owns the register as a whole.
Cycle. Review quarterly at management level and present a summary to the audit or risk committee. Review immediately after any incident, near miss, new provider, change in custody model or material change in holding size.
Challenge. Internal audit or a second-line risk function should test a sample of controls each year and confirm that the residual ratings are supported by evidence.
Linkage. Each control should point to a clause in the treasury policy. When the policy template is updated, check the register still matches it.
Incidents. Log near misses, not just losses. A test transfer that caught an incorrect address is valuable evidence that a control works, and a warning of where it could fail.
How The Bitcoin World helps
We build Bitcoin risk registers aligned to a company's existing enterprise risk framework, including scoring definitions, controls mapping and KRIs, as part of our board advisory work. Execution and custody are carried out by licensed third-party institutions.