Risk Register
Documenting, Tracking, and Managing Organizational Risks
What is a Risk Register?
A risk register (or risk log) is a centralized document that tracks all identified risks facing an organization. It serves as the single source of truth for risk management, enabling consistent tracking from identification through resolution.
Purpose
- Visibility: Executives and teams can see all active risks
- Accountability: Each risk has an assigned owner
- Prioritization: Risks are ranked by severity for resource allocation
- Compliance: Demonstrates due diligence to auditors and regulators
- Trending: Track how risk posture changes over time
Sample Risk Register
| ID | Risk Description | Category | Severity | Owner | Status | Due Date |
|---|---|---|---|---|---|---|
| R-001 | Unpatched Exchange servers vulnerable to ProxyLogon | Vulnerability | Critical | J. Smith | Mitigating | 2026-01-10 |
| R-002 | Third-party vendor lacks SOC 2 certification | Compliance | High | M. Johnson | Open | 2026-02-15 |
| R-003 | Phishing success rate above threshold (15%) | Human | Medium | A. Williams | Mitigating | 2026-01-31 |
| R-004 | Legacy system EOL with no migration plan | Operational | High | T. Brown | Open | 2026-03-01 |
| R-005 | Weak password policy on admin accounts | Access Control | Low | J. Smith | Closed | 2025-12-15 |
Essential Risk Register Fields
While organizations customize their registers, these fields are commonly included:
Risk ID
Unique identifier for tracking (e.g., R-001, RISK-2026-042)
Description
Clear, concise statement of what the risk is
Category
Classification (Technical, Compliance, Operational, Human, Financial)
Likelihood
Probability the risk will materialize (1-5 scale)
Impact
Severity if risk occurs (1-5 scale)
Risk Score
Calculated: Likelihood × Impact
Risk Owner
Person accountable for managing this risk
Mitigation Plan
Actions to reduce likelihood or impact
Status
Current state (Open, Mitigating, Closed, Accepted)
Residual Risk
Risk remaining after controls are applied
Target Date
Deadline for mitigation completion
Last Review
When risk was last assessed/updated
Risk Register Entry Builder
Practice creating a risk register entry. Fill in the fields to see your entry formatted:
Create New Risk Entry
Risk Register Entry PreviewRisk Register Quiz
Test your understanding. You need 80% (4/5) to pass.