What is a risk register?
A risk register is the central record of an organization’s identified risks. Each entry describes the risk, its likelihood and impact, the resulting rating, the owner, and the treatment decision: mitigate, transfer, accept or avoid. ISO 27001, the NIST AI RMF and most other frameworks expect one, kept current and linked to controls.
TL;DR
- One entry per risk.
- Every risk has an owner and a treatment decision.
- Entries link to the controls that treat them.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
How does a risk register work in practice?
A risk register is the system of record for risk management. Each entry typically describes the risk, its likelihood and potential impact, the resulting risk rating, the owner responsible for it, and the treatment plan — whether to mitigate, transfer, accept, or avoid.
Maintaining a risk register is a requirement or expectation across most compliance frameworks, including ISO 27001 and the NIST AI RMF. It provides the evidence trail showing that risks are identified, evaluated consistently, and actively managed.
A living risk register feeds directly into control selection and prioritization: the highest-rated risks justify the controls and remediation work that follow. Linking risks to controls and evidence keeps the register connected to day-to-day operations rather than becoming a static document.
What else do people ask about a risk register?
How often should a risk register be reviewed?
At least annually, and whenever systems, suppliers or threats change significantly.
How does a risk register differ from a risk assessment?
The assessment analyzes and rates risks; the register records the results and tracks each risk’s owner and treatment over time.
Which terms are related to a risk register?
- GRCGRC stands for governance, risk and compliance: the combined practice of setting direction and accountability, managing risks to objectives, and proving adherence to laws, standards and internal policies. Running the three together, with one control library, risk register and evidence base, avoids the duplicated work of separate security, legal and audit processes.
- ISO 27001ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current 2022 edition, amended in 2024, requires a risk assessment, a Statement of Applicability covering 93 Annex A controls, internal audits and management review. Accredited certification bodies certify organizations for three years, with annual surveillance audits in between.
- NIST AI RMFThe NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework, published in January 2023, for managing the risks of AI systems. It organizes the work into four functions, Govern, Map, Measure and Manage, and defines seven characteristics of trustworthy AI. NIST is revising it as part of the White House AI Action Plan.
- Vendor Risk ManagementVendor risk management (VRM) is the process of identifying, assessing and monitoring the security, privacy and operational risks that suppliers and service providers bring. A typical program inventories vendors, tiers them by criticality and data access, reviews questionnaires and attestations such as SOC 2 reports, and tracks remediation and contract terms over time.