What is a risk register?
A risk register is the list of an organisation’s identified risks, each with an owner, a likelihood, an impact, a treatment decision and a review date, linked to the controls that treat it. It is usually the first document an auditor asks to see, because the rest of a compliance programme should trace back to it.
What goes in a risk register
Each row describes one risk in a sentence that names the cause and the effect, such as “a leaver keeps access to production because offboarding is manual”. A vague entry like “cyber attack” cannot be scored or treated, and auditors notice.
- Owner. A named person accountable for the risk, with the authority to accept it or fund its treatment.
- Likelihood and impact. Scored on the scale defined in your risk methodology, before and after treatment.
- Treatment. Reduce, accept, avoid or transfer, with the reason for the choice.
- Controls. The controls that treat the risk, so the link to the Statement of Applicability is visible.
- Review date. When the risk was last looked at, and when it will be looked at next.
What auditors check
ISO 27001 clause 6.1.2 requires a defined, repeatable risk assessment process that identifies risk owners. Clause 6.1.3 requires a risk treatment plan and the risk owners’ approval of it, including acceptance of the residual risk. The standard never uses the words “risk register”, but a register is how most organisations keep the documented information it asks for. ISO 42001 follows the same structure for AI risks. In SOC 2, risk assessment sits under the CC3 criteria, and the auditor will ask how risks are identified and how often the assessment runs.
The common findings are risks with no owner, scores that have not moved in two years, and controls in the Statement of Applicability that no risk explains. Each suggests the register was written for the audit and then left alone.
Keeping it useful
Review the register on a fixed cycle, often quarterly, and whenever something changes: a new product, a new supplier, an incident or a failed audit test. Record what changed and who approved it. Accepted risks need the owner’s sign-off and a date to look at them again.
Some teams add quantitative estimates, such as a Monte Carlo analysis of likely loss, for the few risks large enough to justify the effort. For certification, a clear qualitative scale applied consistently is enough. What matters more is that the scores change when the facts do, and that each treatment decision can be traced to a control and its evidence.
Questions
Risk register, answered
Is a risk register mandatory for ISO 27001?
Not by that name. ISO 27001 requires documented risk assessment results and a risk treatment plan, and in practice a risk register is how almost every certified organisation meets those requirements.
How often should the risk register be reviewed?
At planned intervals you define, commonly quarterly, and whenever a significant change happens. ISO 27001 clause 8.2 expects the risk assessment to be repeated at planned intervals and when significant changes occur.
What is the difference between inherent and residual risk?
Inherent risk is the score before any controls. Residual risk is what remains after them. The register should show both, so it is clear what each control is doing.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them