# Risk register

The list of risks you have identified, with each one's owner, likelihood, impact, treatment and what is left, kept as risk evidence.

Source: https://sted.digital/docs/glossary/risk-register · Last reviewed 17 October 2026 · Strand Glossary

A risk register is the list where you record each risk you have identified: what could happen, who owns it, how likely and how serious it is, how you are treating it, and what is left afterwards. No standard requires the name. It is the usual way to keep the risk evidence that ISO management system standards ask for.

## Where the term appears

ISO 27001:2022 6.1.2 asks you to keep documented information about your risk assessment process, and ISO 27001:2022 8.2 about its results; ISO 42001:2023 6.1.2 does the same for AI risks. A register is the common form of those results. ISO 9001:2015 6.1 asks you to address risks and opportunities but requires no register. For medical devices, ISO 13485:2016 7.1 requires documented risk management in product realisation, which in practice means an ISO 14971 risk management file per device rather than one company register.

### Scenarios, not assets

An auditor tests whether the register drives decisions: each risk has a named owner from the business, a score before and after treatment, a treatment linked to controls, and a review date that has been met. A list of assets with a score beside each is an inventory, not a register. The [risk assessment and treatment page](/docs/standards/iso-27001/risk-assessment-and-treatment) shows a worked register.

## How Sted uses it

The Risks and opportunities register holds each risk's likelihood and impact before and after controls, the controls in place, whether it is above your risk appetite, its treatment plan, an owner and a last-reviewed date, and lists its inherent and residual levels.
Risk levels are computed from likelihood and impact.
For ISO 27001 risk work Sted's knowledge base carries the Risk Management Procedure (PRC-RMP) with its Operating Risk Assessment Record (REC-ORAR) and Operating Opportunity Assessment Record (REC-OORA), and for planned changes the Change Management Policy (POL-CHG) with its Change Record (REC-CR).
Records are part of the Full Management System plan.

## Related terms

- [Residual risk](/docs/glossary/residual-risk): the score after treatment, which the register records.
- [Risk treatment plan](/docs/glossary/risk-treatment-plan): the actions that move a risk from its first score to its residual one.
- [Control](/docs/glossary/control): what a treatment usually puts in place.
- [ISMS](/docs/glossary/isms): the management system the register serves for information security.
- [How to run a risk assessment](/docs/guides/risk-assessment): building the register, step by step.