Risk register

Category: Risk management frameworks · Reviewed by Simon Temme, Account Executive · Last reviewed

Risk register

A risk register is the central record of identified risks, their assessment, ownership and treatment. It is the most basic operational artefact of any risk management system and is referenced in ISO 31000, COSO ERM and the PRA’s Insurance Rulebook.

Minimum columns

A practical register contains, at minimum:

Field	Purpose
Risk ID	Unique reference for traceability
Risk description	Specific, observable event (not a generic category)
Cause(s)	The drivers that could give rise to the event
Consequence(s)	What happens if the event occurs
Inherent likelihood / impact	Pre-control assessment
Current controls	What is in place today
Residual likelihood / impact	Post-control assessment
Risk owner	A named individual (not a committee)
Treatment / action	Tolerate, transfer, treat or terminate, with action owner and due date
Last reviewed	Date of last formal review

Beyond the spreadsheet

In small firms a spreadsheet is sufficient. As complexity grows, registers should integrate with:

The incident log (so that materialised risks update likelihood estimates).
Key risk indicators (so that quantitative measures live alongside qualitative descriptions).
Audit findings (so that control weaknesses feed back into residual ratings).

Common failure modes

Generic risk descriptions (“cyber attack”) that defeat meaningful assessment.
Static heat-map ratings that never change.
Multiple owners listed for a single risk — accountability becomes diffuse.
Treatment actions with no due date or closure evidence.

References

ISO 31000:2018, Clause 6.5 (Recording and reporting).
IEC 31010:2019, Annex B.
COSO (2017) ERM Framework.

Cross-references

Maintained by Matt Bartlett, Director, Apex Insurance Brokers Limited. FCA FRN 724952. Companies House 07014570.

Talk to a specialist broker

Apex Insurance Brokers serves UK professional services firms and commercial businesses. Call 0117 325 0027, email hello@apexinsurancebrokers.co.uk, or request a quotation.

Get a quote