Every risk register looks reasonable until someone reads it against the evidence and the appetite statement. Each scenario hands you an organisation's incident history, control tests and appetite, and asks you to place each risk on a 5x5 matrix, choose a treatment the appetite actually allows, and catch the register entries that would mislead a board - while leaving the sound ones alone.
A veterinary group's first risk analyst rates four risks on a 5x5 matrix, picks a treatment the appetite statement supports, and then checks six existing register rows for an issue posing as a risk, a missing owner and a residual rating that credits a control nobody has built yet.
A freight company's register mixes qualitative and quantitative views. Rate five risks, choose treatments, catch insurance being credited with lowering likelihood, then work SLE and ALE and decide whether a DDoS control pays for itself.
A university's appetite statement has a special rule for research data, and the register quietly ignores it. Rate five risks against a stricter appetite, choose treatments the statement actually permits, and find the lapsed acceptance and the residual that credits a control covering three nodes of eleven.
A payments firm wants its board pack to look calm. Separate tested controls from vendor claims, rate five risks where some controls genuinely do reduce the rating, and find the Very high risk someone accepted that the appetite says may not be accepted at all.