> ## Documentation Index
> Fetch the complete documentation index at: https://help.guardbook.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Reviewing your risk register every quarter

> What clause 3.3 requires of a quarterly review, how to carry one out, and how to record it in guardbook.

Clause 3.3 requires the risk register to be reviewed **and updated** at least quarterly, by the staff responsible for making decisions about the firm's AI use.

Three things are being asked for there, and it is worth separating them.

* **At least quarterly.** No more than three months should pass between reviews. It is also sensible, though not required by the standard, to review when your AI use changes.
* **Reviewed and updated.** Reading the register is not reviewing it. If nothing changed, it helps to say why, although guardbook does not require a note for a risk marked No change.
* **By the right people.** Whoever actually decides how your firm uses AI, not whoever has a spare afternoon.

guardbook has a quarterly review built in. Select **Start quarterly review** on the Risk Register. The button shows when at least one risk is not Closed.

The **Review record** on each risk shows when it was last reviewed, who by, and when the next review is due. It fills in when you sign a quarterly review.

> [!WARNING]
>
> Use **Start quarterly review**, not the **Record review** button on a single risk. Only a signed quarterly review of the whole register sets your next due date and counts towards your GUARD score.
>
> A signed review cannot be edited afterwards. It appears in your evidence pack under Quarterly Risk Register Reviews. The reviewer must be on your People list, so add them there first.

## Running a review

**1. Fix the dates in advance**

guardbook works out when your next review is due: three months after the last signed review. It shows on your dashboard and in reminder emails. About two weeks before, guardbook prepares the review and flags what to look at. Still book the meeting with the people who make the decisions.

**2. Work through every risk that is not Closed**

That includes Mitigated and Accepted risks, and guardbook asks you to mark each one No change or Updated. For each one, ask whether the scores still hold, whether the controls are actually operating, and whether the status is still accurate. Open a risk from the register to see its full record.

**3. Look at what has changed around the register**

New tools on the Tool Register usually mean new risks. Rejected outputs in the Oversight Log often point at a risk that is scored too kindly. A near miss that never made it into the register is the most valuable input a review gets.

**4. Update the register, do not just discuss it**

Change the scores that moved. Move statuses that no longer hold. Add what is missing. Use **Edit risk** on the review screen first (it opens in a new tab), then mark the risk Updated with a short note of what changed.

**5. Sign the review in guardbook**

Choose who carried it out, set the date and write a short summary. If others attended, name them in the summary. guardbook does not check who you choose, so pick someone who makes decisions about your firm's AI use.

## What an assessor is likely to ask

Not "do you have a register". They will ask when it was last reviewed, who by, and what changed as a result.

A register whose entries were all created on one day and never touched again answers that question badly, however well written the entries are. Four modest updates across a year is a stronger record than one immaculate register written the week before an assessment.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.