Glossary term
Risk Register
Subject: Risk Management, Risk Assessment and Quantification
Also known as: Risk log
A risk register is a living record of identified risks, with their ratings, owners, controls and planned actions, kept so that risks can be tracked and reported.
Explanation
Each row describes one risk. Typical columns are a short description, cause and consequence, inherent and residual ratings, the existing controls, the named risk owner, further actions with dates, and status. The register is the working document for a project, a department or the whole organisation. Teams update it at set intervals and whenever something changes, such as a new product, an incident or a regulatory change. Senior committees often see only the top entries, drawn from the register. Many firms hold it in a governance, risk and compliance system, but a spreadsheet works for small teams. A register that is filled once and never revisited is a common weakness. In a review, this is the first record requested, to see who owns each risk and what is being done about it.
Example
A software company's product team keeps a register with 25 entries. One reads: key supplier of cloud services may fail, rated high before controls and medium after a backup supplier contract. The owner is the head of engineering. At each monthly review she updates the rating and the status of the action.
Not to be confused with
- Loss Event Database
- A loss event database records incidents that already happened. A risk register records risks that could happen.