Risk register
Also called risk log, risk inventory
A risk register is the central record of the risks an organisation faces. Each entry describes the risk, its cause and possible impact, its owner, its inherent and residual rating, the controls that manage it and any actions under way. It gives management and the board one view of risk exposure.
How it works
Risks enter the register from risk and control self-assessments, audits, incidents, horizon scanning and new product reviews. Each is linked to a category in the firm's risk taxonomy, such as credit, operational, conduct or financial crime, and to the business units and processes it affects. The owner rates likelihood and impact before controls, records the controls and their effectiveness, then rates the residual risk and compares it with the firm's risk appetite.
Where residual risk sits outside appetite, the register holds the action plan, its owner and deadline. Key risk indicators attached to entries show when a risk is moving. The register is reviewed on a set cycle and after material events, and aggregated into heat maps and reports for risk committees and the board. In governance, risk and compliance platforms the register links directly to controls, tests, issues and incidents, so ratings update as evidence changes.
The rules
Sets out the risk management process, including recording and reporting risk management activities and outcomes, which risk registers commonly support.
Any organisation, voluntaryRequires financial entities to identify, classify and document ICT-supported business functions, information and ICT assets and all sources of ICT risk, and to review the risk assessment at least yearly.
EU financial entitiesRequires the board to monitor and review the risk management and internal control framework and to declare whether material controls were effective at the balance sheet date.
Companies with a premium or equity shares listing in the UK, on a comply or explain basisCommon questions
What columns does a risk register have?
Typical fields are risk ID, title and description, cause and impact, category, owner, inherent likelihood and impact, controls, control effectiveness, residual rating, appetite status, key risk indicators, actions, due dates and last review date.
How often should a risk register be updated?
Firms set a review cycle, often quarterly for key risks, and update entries after incidents, audit findings, regulatory changes or new products. A register that is only refreshed once a year quickly falls out of date.
What is the difference between a risk register and an issues log?
A risk register records things that could happen. An issues log records things that have already gone wrong, such as control failures or breaches, and tracks their remediation. Issues often lead to changes in risk ratings.
