Risk Register

A risk register is a document that tracks identified risks, their likelihood and impact scores, current controls, and treatment plans.

A risk register (or risk log) is the central repository for tracking all identified risks in an organization.

Typical risk register columns: - Risk ID and description - Risk category - Likelihood score - Impact score - Risk rating (L × I) - Current controls - Residual risk - Treatment decision (accept, mitigate, transfer, avoid) - Risk owner - Action items and due dates - Status

Risk treatment decisions: - Accept: Acknowledge and document - Mitigate: Implement controls - Transfer: Insurance or contracts - Avoid: Eliminate the activity

Best practices: - Review quarterly at minimum - Assign clear ownership - Link to controls and evidence

Why It Matters

A risk register is the living document that demonstrates your organization actively manages security risks rather than ignoring them. Auditors will review your risk register to verify that risks are identified, scored, assigned owners, and have documented treatment plans. Without a maintained risk register, organizations cannot demonstrate the risk management maturity that SOC 2, ISO 27001, and other frameworks require.

Key Points

Central document for risk management

Must be reviewed regularly (quarterly+)

Each risk needs an owner

Document treatment decisions

Required by SOC 2, ISO 27001, most frameworks

Applicable Compliance Frameworks

SOC 2 ISO 27001 HIPAA NIST CSF

Related Terms

Risk Assessment

A risk assessment is a systematic process of identifying, analyzing, and evaluating potential threats to an organization's information assets.

Controls Testing

Controls testing is the process of evaluating whether security and compliance controls are properly designed and operating effectively to achieve their intended objectives.

Governance, Risk and Compliance (GRC)

GRC is an integrated approach to managing an organization's overall governance, enterprise risk management, and compliance with regulations, combining these traditionally siloed functions.