What is a risk register?
A risk register is the single, maintained list of the risks an organization knows about. Each entry records what the risk is, who owns it, how it was scored, what is being done about it and when it will be looked at again. Small organizations often keep it in a spreadsheet; larger ones use a governance, risk and compliance (GRC) platform. The format matters less than having one register that every team uses and keeps current.
The register is where the results of risk identification, analysis and treatment are written down. Without it, a risk assessment produces a report that is read once and filed.
What a risk register entry contains
| Field | Example entry |
|---|---|
| Risk ID | RISK-031 |
| Description (cause, event, consequence) | A phished password lets an attacker encrypt the order servers; shipping stops for up to 4 days |
| Category | Operational / cyber |
| Risk owner | Chief operating officer |
| Likelihood, impact, score | 3 x 5 = 15 (high) |
| Current controls | EDR on all hosts; nightly backups to a domain-joined NAS |
| Treatment | Mitigate: phishing-resistant MFA and immutable backups, with due dates |
| Target residual score | 2 x 3 = 6 (medium) |
| Key risk indicator | Percentage of staff accounts without MFA |
| Status and next review | In treatment; review in 90 days |
Quantitatively analyzed risks may carry a dollar figure, such as annualized loss expectancy (ALE), in place of or beside the qualitative score.
Heat maps and key risk indicators
The register feeds the views leadership sees. A heat map plots each risk on a grid of likelihood against impact, typically 5x5, shaded from green to red, so the highest risks stand out at a glance. Executives usually see the top risks, which ones are trending up and which treatments are overdue; the board sees the most serious risks measured against the organization's risk appetite.
Key risk indicators (KRIs) turn the register from a snapshot into an early warning. Examples include the number of critical vulnerabilities open longer than 14 days, the share of privileged accounts without MFA, or failed backup jobs per month. When a KRI crosses its threshold, the owner reviews the risk before an incident forces the question.
Keeping the register current
A risk register is a living document. Periodic reviews follow a schedule the organization sets in its own policy, often quarterly for high risks and at least annually for the full list. Event-driven reviews follow a major incident, a new system or vendor, an acquisition, a new regulation or an audit finding. In each review the owner re-scores the risk against the controls in place today, checks treatment progress, and either closes the entry or keeps it open. Closed risks stay in the history so auditors can see what was decided and why.
Because the register spells out exactly where the organization is weakest, read and edit access should be restricted, as it would be for a penetration test report.
Risk register vs. related documents
- Risk assessment: the activity that identifies and scores risks. The register is the ongoing record of its results and the decisions that follow.
- Heat map: one visual summary drawn from the register.
- Asset inventory: lists what the organization owns. The register lists what could go wrong with it.
- Business impact analysis: measures how harm grows when a business function stops. Its results inform the impact ratings recorded in the register.
Risk register on the CompTIA Security+ exam
The risk register belongs to SY0-801 objective 5.2, which covers the risk management process. Expect scenarios where a manager needs one place to track every identified risk with its owner, score, treatment and status, or where an auditor finds risks that were identified once and never reviewed; both point to the risk register. A question about metrics that warn a risk is growing points to key risk indicators, which are tracked alongside register entries. Common distractors are the business impact analysis, a vulnerability scan report and the risk appetite statement. A scan report lists technical findings without business owners or treatment decisions, and an appetite statement sets limits rather than tracking individual risks.