Risk Management
Risk Register
What This Template Is
The Risk Register template provides a structured format for documenting all identified risks facing an organization, with inherent and residual risk scoring, control linkage, treatment plans, and review scheduling. It is the foundational tool of enterprise risk management.
Who Should Use It
Risk managers building or maintaining the enterprise risk register
Business unit owners identifying and managing risks in their areas
Compliance officers documenting compliance-related risks
Internal audit teams reviewing the completeness of the risk register
What It Contains
Risk identification fields: risk description, category, source, date identified
Inherent risk scoring: impact (1-5), likelihood (1-5), inherent risk score (automatic)
Control documentation: linked controls, control type (preventive/detective/corrective), effectiveness
Residual risk scoring: residual risk score based on control effectiveness, comparison to risk appetite
Treatment plan: treatment type (mitigate/transfer/avoid/accept), actions, owner, target date, target residual risk
Review schedule: next review date, review frequency, review history
Risk appetite comparison: flag if residual risk exceeds the organization's stated risk appetite
When to Use It
- When establishing a risk register from scratch
- During periodic risk reviews and risk refresh cycles
- When new risks are identified through assessments, incidents, or emerging risk scanning
- For board and committee risk reporting
How to Use It
1
Create a risk register from the template within the Risk Management module
2
Define your risk taxonomy and risk appetite before populating risks
3
For each risk, complete the identification, inherent scoring, control, residual scoring, and treatment sections
4
Assign a clear owner for each risk and set review dates based on risk level
5
Use heatmaps and trend analysis to communicate risk posture to the board and track treatment progress