Quick reference
Memory aid
ID it → Rate it (Likelihood × Impact) → Own it → Plan for it → Track it → Review it.
TL;DR
A Risk Register is the operational backbone of risk management: document each risk, assess likelihood and impact, assign an owner, plan the response, and review regularly. Keep it simple, keep it current, and focus on the risks that matter most.
What Is Risk Register?
A master list of all identified risks with key information: what the risk is, how likely and impactful it is, who owns it, what's being done about it, and what's the current status.
A Risk Register is the operational backbone of any risk management program. It captures each identified risk with standardized information including description, category, likelihood rating, impact rating, overall risk score, risk owner, mitigation strategy, current status, and review dates. It transforms ad-hoc risk awareness into systematic risk management by creating visibility, accountability, and a basis for prioritized action. While conceptually simple, an effective risk register requires discipline in maintenance and regular review.
Risk Heat Map
A likelihood-impact matrix used to visualize and prioritize risks in the register.
Origin & context
Evolved from project management practice as the standard tool for documenting and tracking risks. Now a fundamental element of all risk management frameworks.
Core Components
Risk Identification
Clear description of each risk including its cause and potential impact.
Example
Risk #17: 'Key supplier dependency — sole supplier for critical component could fail to deliver, causing production stoppage.'
Risk Assessment
Standardized ratings for likelihood and impact, producing an overall risk score.
Example
Likelihood: 3/5 (Possible), Impact: 5/5 (Critical), Risk Score: 15/25 (High).
Risk Response
The chosen strategy and specific actions to address each risk.
Example
Response: Reduce — qualify a second supplier within 6 months. Accept residual risk of 30-day supply disruption.
Risk Monitoring
Ongoing tracking of risk status, triggers, and effectiveness of responses.
Example
Status: In progress. Second supplier qualification 60% complete. Next review: April 15. Trigger: any delivery delay >5 days.
When to Use Risk Register
Project risk management
Problem it solves: Project risks are discussed informally but not tracked systematically.
Real-world application
A project manager maintains a risk register reviewed at weekly team meetings, tracking 25 active risks with clear owners and actions.
Enterprise risk management
Problem it solves: The organization lacks a comprehensive view of its risk landscape.
Real-world application
A CRO maintains an enterprise risk register aggregating the top risks from all business units, reported to the board quarterly.
Audit and compliance
Problem it solves: Auditors and regulators require evidence of systematic risk management.
Real-world application
During an audit, the company presents its risk register showing identified risks, assessments, mitigations, and review history.
A risk register with 200 risks that's never reviewed is worthless. A register with 20 well-managed risks is invaluable. Focus on material risks and keep the register manageable.
How to Apply Risk Register: Step by Step
Before you start
- →Defined risk categories and assessment criteria
- →Identified risk owners
- →A shared tool or platform for the register
Design the register structure
Define the fields, rating scales, and categorization for your risk register.
Tips
- ✓Keep it simple — too many fields reduce adoption
- ✓Use a 5×5 likelihood × impact matrix
Common mistakes
- ✗Over-engineering the template with too many fields
Populate initial risks
Conduct risk identification workshops to populate the register with current known risks.
Tips
- ✓Include both current and emerging risks
- ✓Cover all risk categories relevant to your scope
Common mistakes
- ✗Only including obvious operational risks; missing strategic and emerging risks
Assign owners and responses
For each risk, assign a named owner and define the risk response strategy.
Tips
- ✓Owners must be individuals with authority to act
- ✓Define specific actions, not just strategies
Common mistakes
- ✗Assigning ownership to teams rather than individuals
Review and update regularly
Establish a regular review cadence to update risk assessments, add new risks, and close resolved risks.
Tips
- ✓Monthly review for active project registers
- ✓Quarterly for enterprise registers
Common mistakes
- ✗Not closing risks that have been effectively mitigated — keep the register current
Value & Outcomes
Primary benefit
Provides a single source of truth for all identified risks, enabling systematic tracking and management.
Additional benefits
- ✓Creates accountability through risk ownership
- ✓Enables risk-based prioritization of resources
- ✓Provides evidence of risk management for auditors and regulators
What you'll learn
- →How to document and assess risks consistently
- →How to prioritize risks based on likelihood and impact
- →How to track risk mitigation progress
Typical outcomes
Best Practices
📋 Preparation
- •Define consistent rating scales before populating the register
- •Agree on risk categories that match your organization
🚀 Execution
- •Review the register at every project/team meeting
- •Focus discussion on the highest-rated risks and action progress
- •Add new risks immediately as they're identified
🔄 Follow-Up
- •Archive closed risks for historical reference
- •Analyze risk trends over time
- •Celebrate successful risk mitigations to reinforce the practice
💎 Pro Tips
- •Create a risk heat map from the register for executive communication
- •Flag 'trending' risks — those with increasing likelihood or impact over recent reviews
The #1 risk register failure is creating it once and never updating it. A risk register must be a living document, reviewed regularly (at least monthly) to remain useful.
The Olympic Delivery Authority, which built the London 2012 venues and infrastructure, tracked key risks through a clear risk hierarchy and used quantified risk analysis to control how its contingency was allocated. The construction program was completed on time, and the UK National Audit Office reported in December 2012 that the Games were expected to come in under the £9.3 billion public sector funding package.
Limitations & Pitfalls
Only captures known risks — unknown risks (black swans) won't appear
Mitigation: Supplement with scenario analysis, emerging risk scanning, and diverse perspectives
Risk scores are subjective and can vary between assessors
Mitigation: Use calibration sessions and clear rating scale definitions
Where this comes fromProject and risk management community introduced this.
More Management Frameworks
Other frameworks in the Stratrix library.
COSO ERM Framework
A comprehensive enterprise risk management framework that integrates risk management with strategy and performance, helping organizations identify, assess, and manage risks across the entire enterprise.
Risk & GovernanceMonte Carlo Simulation
A quantitative risk analysis technique that uses random sampling and probability distributions to model the range of possible outcomes for uncertain decisions, providing probability-based insights rather than single-point estimates.
Risk & GovernanceBowtie Risk Analysis
A visual risk analysis method that maps the causes and consequences of a risk event, along with the preventive and mitigative controls (barriers) in place, creating a complete picture of risk management.
Risk & GovernanceScenario Analysis for Risk
A forward-looking risk assessment technique that explores plausible future scenarios to understand potential impacts and prepare appropriate responses for uncertain events.
Risk & GovernanceFMEA
A systematic method for identifying potential failure modes in a product, process, or system, analyzing their effects, and prioritizing actions to prevent or mitigate failures.
Risk & GovernanceThree Lines Model
A governance model that structures an organization's risk management and assurance activities into three distinct lines: management controls, risk oversight functions, and independent assurance.
More from Stratrix
Test a decision, free
Set a live decision against the companies that made it before you.
AcquisitionsThe Distance TestDivestituresThe Divestiture TestDiversificationThe Diversification TestMake or buyThe Make-or-Buy TestAll Access
Every Casebook, three Strategy Packs a seat each year and the Analyst, for teams that face these decisions all year.
$1,999 a year · $499 a seatWhat is included →New analyses, by email
The defining moves in business, checked against the record, as they publish.
See Risk Register in the wild.
Follow Risk Register across the companies and lenses where it actually shaped the strategy — the decision, the rationale, and how it played out.