Risk register for exams, gradebooks, and report cards

1. Define the register boundary

List subjects, cohorts, campuses, grading periods, assessments, components, attempts, submissions, marks, grades, calculations, reports, moderation, users, integrations, exports, backups, support, and suppliers.

Use one consistent record: risk, cause, affected object, consequence, likelihood, impact, owner, control, evidence, trigger, due date, status, residual risk, and next review.

2. Identify record risks

Consider duplicate learners, wrong subject or cohort, stale grading periods, unclear scales, hidden formulas, invalid ranges, missing or duplicate results, ambiguous statuses, weak corrections, and report differences.

Test missing submission, late work, absent learner, amended mark, moderation adjustment, resit, special consideration, withdrawal, transfer, duplicate entry, report correction, and changed period.

3. Identify control and delivery risks

Review role boundaries, moderation, approval, publication, exports, staff leavers, suppliers, identity matching, failed integration, retry, reconciliation, backup, restoration, retention, disposal, incident response, training, and reporting deadlines.

The U.S. Department of Education data governance checklist covers quality, access, security, lifecycle, sharing, disposal, and monitoring. GOV.UK guidance emphasises accountable handling of school data.

4. Assign useful controls

A control should name action, actor, timing, evidence, exception route, and review. Examples include assessment dictionary, range validation, calculation test, moderation sample, permission review, migration reconciliation, publication check, recovery drill, or role rehearsal.

Apply qualified local assessment, privacy, safeguarding, records, security, accessibility, and legal review before assigning compliance meaning to a control.

5. Monitor residual risk

At 30, 60, and 90 days, review calculation differences, moderation, corrections, access exceptions, support demand, staff effort, report confidence, failed integrations, and unresolved owners.

Change risk status only with evidence. Record whether the school will expand, repair, consolidate, narrow, hold, or accept the residual risk and who approved that decision.

Turn the guidance into an assessment decision

Apply this guidance to one bounded part of risk register for school exam and gradebook software. Define the assessment or reporting decision, authoritative record, accountable owner, permitted users, correction route, evidence, and review date.

Test an ordinary assessment and meaningful exceptions such as a missing submission, late work, absent learner, moderation change, amended result, withdrawn learner, duplicate mark, grading-period change, report correction, access failure, or outage.

Keep supplier capability, school responsibility, professional judgement, local policy, legal advice, and measured outcome separate. If evidence is incomplete, narrow the claim and pilot the smallest safe change.

Review at 30, 60, and 90 days. Check completeness, timeliness, consistency, moderation, corrections, access exceptions, staff effort, support demand, reporting confidence, and the original outcome. Decide whether to expand, repair, consolidate, narrow, or hold.

Before approval, ask a reviewer who was not involved in the design to challenge the strongest assumption. Replace broad language with the exact evidence, population, date, and limitation the school can verify.

Document what was tested and what was not. A successful demonstration with a simple gradebook does not establish readiness for moderation, resits, special consideration, changed grading periods, multiple campuses, or a changed assessment policy.

Keep evidence beside the decision record so a later reviewer can distinguish observed behaviour from an assumption, estimate, or supplier statement. Name the next test where evidence remains incomplete.

Revisit the boundary when the school adds a subject, year group, campus, grading scale, role, integration, reporting period, or policy. A small change can alter permissions, definitions, calculation, timing, retention, or support demand.

Set the next review date and owner. A dependable exams and gradebook operation is maintained through clear definitions, controlled change, professional judgement, and visible accountability rather than a one-time setup.

Make the handoff readable to a teacher, administrator, leader, learner, and reviewer. State what passed, what remains manual, which records are authoritative, who owns unresolved conflicts, and how a correction is communicated without creating an uncontrolled copy.

Keep approved definitions beside calculation rules, moderation notes, training, support routes, and change history. New subjects, scales, integrations, or reporting windows can change the risk even when field names stay the same.