A risk register is a list of the risks an organisation has identified, with a view on how likely and how serious each is, who owns it, and what is being done. It has one job: helping management decide where to act. If it is updated once a year and read by nobody, it is a record, not a tool.
What a useful register does
It lets a leader answer three questions quickly. What are our biggest risks? Who is dealing with each one? Are we doing enough? If the register cannot answer those, it needs work, however well formatted it is.
Write risks clearly
A risk is not a topic, such as "cloud", and not a control gap, such as "no MFA". A clear statement names a cause, an event and a consequence: because of this, that could happen, leading to this impact. It lets people judge likelihood and impact with some honesty.
Use consistent rating criteria
If one team rates a risk high and another rates a similar one low, comparison is meaningless. Define what each level of likelihood and impact means, including in terms the business recognises, then rate against those definitions.
Name an owner for every risk
The owner is the person with the authority to decide what to do about it, not the person who recorded it.
Link risks to controls and treatments
For each risk, record what already reduces it and what further action is planned, with a date and an owner. Then the register shows whether the work you are doing matches the risks you have.
Review on a rhythm
Risks change when the business, technology and threats do. Review the highest risks often, and the rest on a regular cycle. Record when a risk is accepted, and by whom.
Keep it short enough to read
A register with hundreds of entries hides the ones that matter. Group related risks, retire old ones and focus attention on the few that could really hurt.
An organisation’s risk register listed system downtime as a high risk, but the entry had remained unchanged for months, with no clear owner or treatment plan. During a review, management discovered that a critical service depended on a single infrastructure provider, with no tested recovery arrangement. The risk was reassessed, assigned to the technology lead, and prioritised for a resilience improvement project.
