Home / Knowledge hub / Risk register
Knowledge hub
Risk register
A running list of risks, their owners, ratings and chosen responses.
What it means
A risk register is a living record of the risks your organisation has noticed. Each entry names the risk, its owner, how likely and how damaging it is, what you plan to do about it, and when it will next be reviewed. It is usually a spreadsheet or a tool, kept up to date, not a document written once.
NIST describes it as a way to record and track risks so that management can see them together and decide. The response is one of four: reduce, accept, transfer or avoid. A risk that is accepted still goes on the register, with a name beside the decision.
Why it matters
It turns scattered worries into decisions. Without one, a known weakness lives in somebody's head and is forgotten when they leave. With one, leadership can see which risks exist, who owns each, and which have been accepted on purpose. That is the record auditors, insurers and enterprise customers want to see.
It also links your security work to the business. A finding from a test becomes a risk when it is judged against what it could cost. Formal risk acceptance belongs on the register, and frameworks such as ISO 27001 expect a documented process for it.
How it shows up
Entries come from many places: penetration test results, incidents, audits, supplier reviews and design discussions. Keep the register short and useful. Group related findings into one risk, rate each risk the same way, and record the evidence behind the rating. Link each entry to its evidence.
The register fails when it becomes a graveyard. Common signs are no owners, no review dates, ratings that never change and risks that are accepted indefinitely. Review it on a schedule, remove closed items with proof, and link each item to the ticket or finding that backs it.
Questions people ask
Risk register, answered
What should a risk register contain?
At minimum: a description, an owner, a likelihood and impact rating, the response chosen, actions with dates, and the next review date.
Add the evidence or ticket that supports the rating.
Is a risk register the same as a list of vulnerabilities?
No. A vulnerability list shows individual flaws. A register shows risks to the business, which may combine several flaws or include non-technical issues such as a single point of failure.
Findings feed the register but are not the same thing.
Who owns the risk register?
Usually a security or risk lead keeps it, but each risk has a named owner in the business who decides on it.
The owner is the person with the authority to accept or fund the response.
How often should it be reviewed?
Set a schedule, commonly quarterly, with high risks looked at more often. Update it after any major incident or change.
A register unchanged for a year is a warning sign.
Do auditors ask for one?
Often. ISO 27001 and similar frameworks expect a documented risk process, and a register is the usual evidence.
They look for owners, dates and signs it is actually used. Auditors also compare the register with incident records and test reports.
Related
Terms that sit next to this one
Risk acceptance
Deciding, on the record, to live with a known issue rather than fix it.
Risk rating
A combined view of how likely a flaw is to be used and how much harm it would do.
Business impact
What a flaw would cost in money, customers, uptime or trust if used.
ISO 27001
The international standard for running an information security management system.
Vulnerability management
The loop of finding, prioritising, fixing and checking the fix held.
What would you put on the register?
A risk is easier to rate when the evidence is clear. Each finding of ours shows what was exploited, with request, response and the line of code. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.