Risk register
A risk register is the list where you record each risk you have identified: what could happen, who owns it, how likely and how serious it is, how you are treating it, and what is left afterwards. No standard requires the name. It is the usual way to keep the risk evidence that ISO management system standards ask for.
- Clauses
- ISO 27001:2022 6.1.2 · ISO 27001:2022 8.2 · ISO 9001:2015 6.1 · ISO 13485:2016 7.1 · ISO 42001:2023 6.1.2
Where the term appears
ISO 27001:2022 6.1.2 asks you to keep documented information about your risk assessment process, and ISO 27001:2022 8.2 about its results; ISO 42001:2023 6.1.2 does the same for AI risks. A register is the common form of those results. ISO 9001:2015 6.1 asks you to address risks and opportunities but requires no register. For medical devices, ISO 13485:2016 7.1 requires documented risk management in product realisation, which in practice means an ISO 14971 risk management file per device rather than one company register.
Scenarios, not assets
An auditor tests whether the register drives decisions: each risk has a named owner from the business, a score before and after treatment, a treatment linked to controls, and a review date that has been met. A list of assets with a score beside each is an inventory, not a register. The risk assessment and treatment page shows a worked register.
How Sted uses it
- The Risks and opportunities register holds each risk’s likelihood and impact before and after controls, the controls in place, whether it is above your risk appetite, its treatment plan, an owner and a last-reviewed date, and lists its inherent and residual levels.
- Risk levels are computed from likelihood and impact.
- For ISO 27001 risk work Sted’s knowledge base carries the Risk Management Procedure (PRC-RMP) with its Operating Risk Assessment Record (REC-ORAR) and Operating Opportunity Assessment Record (REC-OORA), and for planned changes the Change Management Policy (POL-CHG) with its Change Record (REC-CR).
- Records are part of the Full Management System plan.
Related terms
- Residual risk: the score after treatment, which the register records.
- Risk treatment plan: the actions that move a risk from its first score to its residual one.
- Control: what a treatment usually puts in place.
- ISMS: the management system the register serves for information security.
- How to run a risk assessment: building the register, step by step.