A Risk Register is the authoritative, structured repository — document or digital record — that serves as an organization's single source of truth for identified IT risks. Each entry captures: risk description, category, ownership, inherent risk rating (pre-control), controls in place, control effectiveness, residual risk rating (post-control), treatment disposition, treatment plan, and review schedule. As the primary output of the risk identification and assessment process, the Risk Register converts unstructured risk knowledge into a governed, trackable, and actionable inventory that drives risk response decisions and executive reporting.
Where it stops · what it isn't
- —IS: A living repository that documents, categorizes, rates, and tracks risks through their full lifecycle — from identification through resolution or formal acceptance.
- —IS: The operational artifact that links risk identification inputs to risk treatment and monitoring outputs within the IT risk management lifecycle.
- —IS NOT: A risk heatmap or dashboard — those visualization tools are derived FROM the Risk Register, not the register itself.
- —IS NOT: A vulnerability list, audit finding log, or incident report — those sources feed the register, but the register synthesizes them into governed records with ownership and treatment context.
- —IS NOT: A static compliance checklist — a register not regularly reviewed and updated loses governance value and may create false assurance.
- —IS NOT: A substitute for Risk Scenario Development — the register records identified risks at summary level; detailed scenario narratives are a downstream artifact.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
REQUIRESRisk Analysis MethodologiesRisk Identification Techniques
ENABLESRisk Scenario DevelopmentRisk Treatment and Response PlanningBoard-Level IT Risk Reporting
PART OFIT Risk Assessment Domain (CRISC Domain 2)
RELATED TOBusiness Impact AnalysisVulnerability Analysis
CONSTRAINSRisk Appetite and Tolerance Thresholds