What it means
A useful register is more than a list. It preserves the decision trail, connects each risk to affected objectives and assets, and records who must act or accept the remaining exposure.
Why it matters
A current register helps leaders prioritize treatment, track accountability, detect recurring themes, and avoid rediscovering the same risk during every assessment.
Practical focus
- Write risks as cause-event-impact statements
- Record inherent and residual ratings separately
- Assign one accountable risk owner
- Track response milestones, evidence, and review dates
Common mistakes
- Listing vulnerabilities without business impact
- Allowing duplicate risks to accumulate
- Closing a risk because a task was completed
- Using the register only during audits
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: