QULDEXResources · Glossary
What is a risk register? Contents, example and upkeep
What is a risk register for?
A risk assessment is a point-in-time exercise. The register keeps its results alive: who owns each risk, what is being done, and whether the position has changed.
Auditors read the register to check that risks were assessed with a consistent method, that each has an owner, and that the controls in place follow from the treatment decisions.
What should each entry contain?
What could happen, to what, and why. Specific enough that two people would agree what it means.
Scored with your documented method, before and after treatment.
Who is accountable, what will be done by when, and the next review date.
What does a risk register entry look like?
One entry from an information security risk register.
| Item | What it looks like |
|---|---|
| Risk | Former staff retain system access because leaver notices reach IT late |
| Inherent score | Likelihood 4 of 5, impact 4 of 5: 16, high |
| Treatment | Reduce: link account removal to the HR leaver process |
| Owner and date | IT operations lead; due 30 Nov 2026 |
| Residual score | Likelihood 2, impact 4: 8, medium; accepted by the risk owner |
This is an illustration written for this page, not a customer record.
Which frameworks require a risk register?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clauses 6.1.2, 8.2 | Risks are assessed with a defined method, and the results are kept as documented information. |
| ISO 27001 | Clauses 6.1.3, 8.3 | A risk treatment plan is produced, approved by risk owners, and its results are kept. |
| ISO 31000 | Clause 6.7 | The risk management process and its outcomes are recorded and reported. |
| SOC 2 | CC3.2 | Risks to objectives are identified and analysed as a basis for deciding how to manage them. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What makes a risk register unreliable?
Written once a year
The register is updated just before the audit.
Instead: review it when things change and at set intervals.
Vague risks
'Cyber attack' cannot be scored or treated.
Instead: name the asset, the cause and the consequence.
No link to controls
Risks and controls are kept in separate lists.
Instead: link each treatment to the controls that deliver it.
How does QULDEX handle this?
Risks scored on your own matrix, each with an owner, a treatment and a review date, linked to controls and audits.
Risk Register: common questions
What is the difference between inherent and residual risk?
Inherent risk is the level before treatment. Residual risk is what remains after the treatment is in place.
Does ISO 27001 require a risk register?
It does not use the term, but it requires documented information about the risk assessment results and the risk treatment plan. A risk register is the usual way to hold them.
How often should a risk register be reviewed?
At planned intervals and whenever significant changes occur, such as a new system, supplier or incident.
A risk register that stays current
Controls, evidence, findings and corrective actions in one audit workspace.