Risk register

Reviewed by Apex Insurance Brokers · Last reviewed 2026-06-22

Reviewed by Apex Insurance Brokers · Last reviewed 2026-06-22

Reviewed by Apex Insurance Brokers · Last reviewed 2026-06-22

Category: Risk management frameworks · Reviewed by Simon Temme, Account Executive · Last reviewed

A risk register is the central record of identified risks, their assessment, ownership and treatment. It is the most basic operational artefact of any risk management system and is referenced in ISO 31000, COSO ERM and the PRA’s Insurance Rulebook.

Minimum columns

A practical register contains, at minimum:

Beyond the spreadsheet

In small firms a spreadsheet is sufficient. As complexity grows, registers should integrate with:

• The incident log (so that materialised risks update likelihood estimates).
• Key risk indicators (so that quantitative measures live alongside qualitative descriptions).
• Audit findings (so that control weaknesses feed back into residual ratings).

Common failure modes

• Generic risk descriptions (“cyber attack”) that defeat meaningful assessment.
• Static heat-map ratings that never change.
• Multiple owners listed for a single risk — accountability becomes diffuse.
• Treatment actions with no due date or closure evidence.

References

• ISO 31000:2018, Clause 6.5 (Recording and reporting).
• IEC 31010:2019, Annex B.
• COSO (2017) ERM Framework.

Cross-references

• Risk heat map
• Risk matrix
• Inherent risk
• Residual risk

Maintained by Apex Insurance Brokers. FCA FRN 724952. Companies House 07014570.