What Is a Risk Register?
A risk register is a centralized repository that documents all identified risks facing an organization, along with their assessments, owners, treatments, and status. It is the foundational tool of enterprise risk management, providing a single source of truth for the organization's risk landscape.
What a Risk Register Contains
A comprehensive risk register includes: risk description, risk category, inherent risk rating (impact × likelihood before controls), risk owner, controls in place, control effectiveness, residual risk rating (after controls), risk treatment plan, treatment owner, target residual risk, and review dates. Each risk should have a clear, accountable owner.
Inherent vs. Residual Risk
Inherent risk is the level of risk before any controls are applied — it represents the raw exposure. Residual risk is the remaining risk after controls are in place. The gap between inherent and residual risk reflects the effectiveness of controls. If residual risk is still above the organization's risk appetite, additional treatment is required.
Risk Categories
Risks are typically categorized into: strategic risk, operational risk, financial risk, compliance risk, cyber risk, third-party risk, reputational risk, and ESG risk. Categorization helps with reporting, ownership allocation, and trend analysis. MPG supports custom risk taxonomies tailored to your organization.
How MPG Supports Risk Register Management
MPG's risk management module provides a comprehensive risk register with inherent and residual risk scoring, control linkage, treatment plans, risk appetite comparison, heatmaps, trend analysis, and board-level reporting. Risks identified through third-party assessments, compliance reviews, and cyber assessments automatically feed into the register.
Key Takeaways
- A risk register is the single source of truth for organizational risk
- Each risk has inherent risk (before controls) and residual risk (after controls)
- Every risk needs a clear, accountable owner
- Risks from all governance domains — third-party, compliance, cyber — should feed into a unified register
Frequently Asked Questions
How often should a risk register be updated?
A risk register should be continuously updated — new risks are added as they are identified, existing risks are reassessed when circumstances change, and treatment progress is tracked in real time. MPG supports continuous risk register management with real-time updates and automated review reminders.
What is the difference between a risk and an issue?
A risk is a potential future event that could affect objectives; an issue is a current problem that has already occurred. Issues are managed through action tracking; risks are managed through the risk register with treatments and monitoring.
Who owns the risk register?
The risk function typically owns the register, but individual risks are owned by the relevant business units or functions. MPG assigns clear ownership for each risk and tracks treatment progress through to completion.