Risk Register
A structured document or database that records all identified risks, their assessment details (likelihood, impact, rating), assigned risk owners, selected treatment options, current control status, and residual risk levels. It serves as the central repository for an organization's risk management activities.
The risk register is the operational backbone of an organization's risk management program. It provides a consolidated view of all identified risks, enabling consistent tracking, prioritization, and management. A well-maintained risk register typically includes for each risk: a unique identifier, description, risk category, likelihood assessment, impact assessment, overall risk rating, risk owner, selected treatment option, current controls in place, residual risk level, status of any planned actions, and review dates. The register transforms risk management from an abstract exercise into a concrete, actionable management tool.
Maintaining a risk register is a fundamental requirement across compliance frameworks. ISO 27001 Clause 6.1.2 requires organizations to apply the risk assessment process to identify, analyze, and evaluate information security risks — the risk register is the natural artifact for documenting these results. While ISO 27001 does not prescribe the format, auditors expect to see a comprehensive, current risk register during certification audits. SOC 2 auditors look for evidence of a systematic risk management process, and a risk register demonstrates that risks are identified, assessed, and managed on an ongoing basis. NIS2 requires management bodies to oversee cybersecurity risk management, and the risk register provides the transparency needed for effective governance oversight.
For the risk register to be valuable rather than a compliance checkbox, it must be treated as a living document. Risks should be added when identified through assessments, incident investigations, audit findings, or changes in the business environment. Risk ratings should be updated as the threat landscape, business context, or control effectiveness changes. Risk owners should review their assigned risks regularly, and the overall register should be reviewed at management review meetings. Modern governance, risk, and compliance (GRC) platforms provide automated risk register capabilities with workflow, notification, and reporting features. However, even a well-structured spreadsheet can serve as an effective risk register for smaller organizations, provided it is maintained consistently and reviewed regularly.
Related frameworks
Related terms
Residual Risk
The level of risk that remains after security controls and risk treatment measures have been applied. Residual risk must be formally evaluated and accepted by management to ensure it falls within the organization's defined risk appetite.
Risk Appetite
The level and type of risk an organization is willing to accept in pursuit of its objectives. Risk appetite defines the boundaries within which the organization operates and guides decision-making about which risks to accept, mitigate, transfer, or avoid.
Risk Assessment
A structured process for identifying, analyzing, and evaluating information security risks. Risk assessments determine the likelihood and potential impact of threats to an organization's information assets, guiding decisions about which controls to implement.
Risk Treatment
The process of selecting and implementing measures to modify identified risks. The four primary risk treatment options are risk mitigation (applying controls to reduce risk), risk acceptance (acknowledging and tolerating the risk), risk transfer (sharing risk with a third party such as an insurer), and risk avoidance (eliminating the risk by ceasing the activity).
Threat Modeling
A structured approach to identifying, categorizing, and prioritizing potential security threats to a system or application by systematically analyzing its architecture, data flows, and trust boundaries to determine where vulnerabilities might be exploited.
Assess your compliance posture
Run a free self-assessment for ISO 27001, SOC 2, GDPR, NIS2, or Tech DD and see exactly where you stand.
Start free assessment