What Is a Risk Register?

Definition

Picture one table with one line per risk. A line connects a cause to a consequence, then adds a score, an owner, a decision and the date of the next review.

You will not find the words “risk register” in ISO/IEC 27001. The standard asks for documented results of risk assessment (clause 8.2) and risk treatment (clause 8.3), and most companies keep both in this one table.

Why it matters

Ask a manager which risks the company has accepted, and who signed for them. If the answer means searching through old emails and slide decks, there is no real risk management yet, only worry.

The register is also the first thing an auditor or an insurer asks to read, because a dated decision proves far more than a good intention.

How it works

The hard part is the first sentence. “Cyber risk” cannot be scored or treated by anyone. “Ransomware through the IT provider's remote access stops order taking for three days” can, because it names the event, the route in and the damage.

Next, score that sentence on the scale the whole company uses and name one owner. Record the decision and list the actions with their dates. Then score the risk again as it will stand once those actions are finished, since that second figure is what management actually accepts.

From then on the register lives on a fixed rhythm, plus an extra review after any incident or major change. Date every edit and give its reason. A year later, that history is what explains why a score moved.

A worked case

A vaccine distributor with one warehouse writes: “Cold room failure overnight spoils the stock.” Likelihood 2 out of 5 and impact 5 out of 5 give a score of 10, and the warehouse manager owns it.

The decision is to reduce the risk. An alarm to the on-call phone goes in by 15 March, and a second supplier for emergency cold storage is signed by 30 April. Both done, the expected score falls to 5, and the line comes back for review in September.

Good practices

• Pick an owner who can spend money or change the process. A department cannot answer a question in a meeting.
• Keep the initial and residual scores side by side, so that the value of the work shows.
• Link each line to the asset or process it threatens. When that system changes, you will know which risks to reopen.
• Start with the fifteen or twenty risks that matter. A first version of two hundred lines rarely survives its second review.

Common mistakes

• Listing threats such as “phishing”. A threat has no consequence attached, so nobody can tell how much it matters here.
• Scoring almost everything high. It often comes from fear of being blamed later, and it leaves management unable to choose.
• Closing a line the day its action is finished. The action reduces the risk; what remains still needs an owner and a decision.

Questions

What is the difference between a risk register and a risk assessment?

The assessment is the work of finding and scoring risks. The register is where the results are kept and followed afterwards.

Does ISO 27001 require a risk register?

Not by that name. It requires documented assessment and treatment results, and a register is the usual way to hold them.

How often should it be reviewed?

Quarterly suits most companies, with an extra review after an incident or major change. ISO/IEC 27001 only requires planned intervals, so the rhythm is yours to set.

Who owns the register itself?

One person keeps it current, often the risk or security lead. Each line inside it has its own owner.

Can a spreadsheet do the job?

Yes. Spreadsheets fail when several copies circulate and nobody knows which is right, so keep a single copy and restrict who can edit it.

How many risks should it hold?

As many as management can actually discuss. Many smaller companies work well with twenty to fifty.