A risk register for US Oncology Compliance

A spreadsheet, an inbox and a slide deck

Every quarter, Compliance had to ask business owners for their risk updates, then prepare a report for leadership. The report needed three answers. Which commercial risks need attention? Who owns each mitigation plan? What changed since last quarter? Getting them took a spreadsheet, a round of reminder emails and a slide deck rebuilt by hand for leadership. Keeping an audit trail across spreadsheet versions was manual too.

I worked on the project as a UI/UX Business Analyst and AI Engineer, planned at half time. I sat between the Compliance business owner and ECS, AstraZeneca's delivery team in India, which built the app in Power Apps. I wrote the requirements spec, built the interface prototypes and coordinated business testing. The business owner and Compliance made the product calls. My job was to turn each call into something ECS could build and she could check.

The dashboard moved twice

The October 2025 plan put data entry, email reminders and a Power BI dashboard in the first release. A chatbot came next, and other regions last. From the start the team put data entry ahead of the chatbot.

In February, after talking with her manager, the business owner moved the dashboard to Phase 2. ECS had already started building it. In April, Compliance moved it again, to Phase 3, so Phase 2 could focus on the registers and policy exceptions. The Global team's register went the other way, from last in line into Phase 2.

Each move was her call or Compliance's. My part was to make each call stick. I carried every change into the spec's scope table, which listed seven deferred items by February. Nothing could drift back in unless someone decided it should.

Keeping the build date

In late January most of the wireframes were ready and a few weren't. The business owner and I prepared the review meeting together, and one success criterion was that the 13 February development target held. So I proposed splitting the sign-off. Seventeen screens were ready, and she approved them that day. Five changes were label-only, with no database impact. We agreed those in writing, each traced to its requirement, and ECS applied all five the next day.

Who changed what, and why

The spec did two jobs. ECS built from it, and it recorded who decided what. Every version has a row saying what changed and whose review drove it, whether that was the business owner, Compliance reviewers or ECS.

It ran to 18 versions between November 2025 and April 2026. Sixteen came in April, while we scoped Phase 2 and the business owner worked in the live app. Several versions followed the April walkthrough and review sessions.

The reviews were detailed. On one February draft the business owner left 23 comments and dozens of tracked edits. I resolved all of them into a clean version before the build.

Two rules that came out of review

Compliance ruled that nobody could delete a risk record. Delete became a Canceled status with a required reason. I specified what happens underneath. Open mitigations under a canceled risk are canceled with it, and completed ones are kept.

The business owner caught a wording problem too. A blank quarterly update doesn't mean the mitigation is late. It means nobody has recorded it yet. Calling it Overdue would put a negative judgment on an owner before anyone knew whether the work was done. I changed the rule and its label to Missing. That gave the reviewer a question to resolve instead of a false conclusion.

43 observations in four days

Business testing ran from 17 to 20 February 2026. ECS sent the app link the day before it started, after the business owner and I had asked for early access for weeks. The night before, I sent one updated spec that took in a week of feedback, with 41 changes traced to their requirements.

The business owner logged 43 observations. 32 were minor, 7 medium and 4 major. ECS fixed 32 inside the window. All four major items came back marked "deferred to Phase 2". One was the overdue rule. Another was the logic of the My Work tab, which ECS said could affect the stability of the release.

Who gets to say "later"

Deferring those four may well have been the right call. The problem was who made it. ECS was moving work out of the release, and the business owner hadn't agreed to it.

So the rule came after the deferrals. On 23 February the business owner, the IT leads and I met and agreed it. Nothing moves to Phase 2 without her explicit approval and a documented effort estimate. I wrote the process that put the rule into practice, and the tracker template behind it.

The process opens with one line. ECS owns the process, the business owner approves, and I facilitate and escalate. For each proposed deferral, ECS writes up the reason, an effort estimate and the business value, and links the write-up from the tracker row. The item stays In Progress until she decides. If she says no, ECS delivers it in Phase 1 or proposes an alternative.

I kept my own part narrow. I would step in only if an item sat Open for more than two business days or stayed disputed across two stand-ups. That kept the decision with the person who owned it.

Live in March 2026

The original plan said January. A revised plan in February said the end of that month. The first release went live in March 2026, about two months after the original date. The last gate was the business owner approving the final requirements in the company's document system on 11 March.

That approval needed a Phase 1-only document. ECS removed the Phase 2 material and restructured the spec before she signed, so the approved Phase 1 version is partly their text.

Access isn't accountability

One team's business owners had helpers who did their quarterly data entry. A helper needed to enter progress without becoming accountable for the risk. The only way to give that helper access was to label them a business owner too. That put the wrong person on the accountability record. I specified a Contributor role. Contributors can update mitigation progress, attach supporting documents and submit updates for review. They can't edit the risk itself, and the version history shows the Contributor's name, not the owner's.

Reports without progress

The business owner needed mitigation progress in her compliance committee reports, and the export couldn't include it. I mocked up field selection and specified year and quarter filters, with each file recording its filters, author, date and spec version.

Saying what waits

Phase 2 for the US register and the Global register was approved on 16 April 2026. It covered a My Tasks view, the Missing rule, the Contributor role and reporting. Compliance hadn't approved the policy-exception workflow, so I gave it its own section of the spec. The compliance part tells that story.

Most of the scope work was deciding what waited. In the April deck I kept a log of ten ideas we had talked about and left out of Phase 2. Each line said who raised the idea, what happened to it and why.

In May 2026 I began handing the requirements work to a colleague and moved to the Global Medical Affairs AI Workbench. I don't know whether Phase 2 shipped.