Guide · 7 min read
Building a risk register people actually use
How to build a risk register that leadership actually reads: clear risk statements, honest inherent and residual ratings, owners with authority, KRIs and regular clean-up.
I have seen risk registers with 400 lines that nobody had opened since the last audit. I have also seen ones with 25 lines that the leadership team argued over every month. The second kind is the one you want. Here is how to get there.
Write risks people can act on
"Cyber attack" is not a risk. It is a topic. A useful risk statement has a cause, an event and an impact:
Because admin accounts on the payment platform don't use MFA, an attacker with a phished password could take control of the platform, leading to fraud losses and a breach of PCI DSS.
Written this way, the owner knows what to fix (MFA on admin accounts), and leadership can see why it matters. If you can't write the cause, you don't understand the risk yet.
Keep it short
A register is a decision tool, not an inventory. If something would never be discussed at a risk meeting, it probably belongs in a team's own tracker. Aim for the risks that need management attention: usually 15 to 40 for a mid-size company.
Be honest about inherent and residual
Inherent risk is the risk before your controls. Residual is what is left after them. The trap is taking credit for controls that exist on paper. Only reduce the rating for controls that have been tested and work. If the MFA rollout is "planned", the residual hasn't moved.
Owners need authority, not just a name
The risk owner should be someone who can spend money or change a process to treat the risk. Assigning every cyber risk to the CISO is a common mistake: the CISO can advise, but the business owner of the payment platform is the one who can accept the risk or fund the fix.
Compare with appetite, then choose a treatment
Every risk should be compared with the appetite the board has set. Above appetite means you treat it (reduce, transfer or avoid) or someone with enough authority formally accepts it, with an expiry date. "Accept" without an approver and a date is just ignoring it politely.
Add a couple of KRIs to the risks that matter most
A key risk indicator tells you the risk is moving before it becomes an incident. For the MFA example: "percentage of admin accounts without MFA", with a threshold that triggers escalation. Pick indicators that measure risk, not activity. "Number of phishing emails blocked" says your filter is busy, not that you are safer.
Clean it up every quarter
- Close risks whose cause has gone, with a note on why.
- Chase overdue treatment actions and expired acceptances.
- Reassign risks whose owner has moved on.
- Re-rate anything where an incident or audit finding changed the picture.
A register that is honest, short and reviewed is worth far more than a long one that looks complete. Leaders use it because it tells them something they didn't know.