A risk register earns its keep when leadership uses it to decide where money and effort go. It fails when it is a compliance artefact refreshed once a year for the auditor. The difference is rarely the template. It is whether scoring is consistent enough to compare risks across teams, whether every treatment has an owner and a date, and whether residual risk is re-measured after the work is done.
Calibrate scoring before you collect risks
Inconsistent scores usually come from undefined scales. If one team's "high impact" is a day of downtime and another's is a regulatory fine, the heatmap is meaningless. Define each level in business terms, get the scale approved, and run a short calibration session where owners score two or three sample risks together before they score their own.
Example impact scale (adapt thresholds to your organization)
Write the method down in a risk assessment methodology covering scales, how inherent and residual risk are scored, risk appetite thresholds, and who can accept what level of risk. ISO 27001 requires a defined, repeatable risk assessment process, and auditors will test that results are consistent with it.
Treatment plans that actually finish
Treatment loses momentum when it is recorded as an intention instead of a piece of work. Each risk above appetite needs a treatment decision: mitigate, transfer, avoid, or accept. Mitigation should be broken into actions with an owner, a due date, and a target residual score the action is expected to achieve. Acceptance needs an approver with the authority to accept that level of risk, and an expiry date so it is revisited rather than forgotten.
A treatment plan is complete when it has
- A single accountable owner, not a team name
- Specific actions with due dates, tracked where the doing team already works
- A target residual score and how it will be verified
- An escalation point if a date slips more than once
- For accepted risks, an approver and a review date
Key risk indicators and who reads them
The risk manager's year
Run a full risk assessment at least annually and whenever significant change happens, such as a new product, acquisition, major cloud migration, or new regulation. Hold a monthly or bi-monthly treatment review with owners. Report quarterly to the risk or audit committee. Feed the results into the annual management review, and refresh the register before internal audit plans the year, since a risk-based audit plan depends on it.
Handoffs with the rest of the program
- With the CISO: agree appetite, escalation thresholds, and which acceptances need executive sign-off.
- With compliance: every audit finding and control failure is assessed for risk, and every mitigating control links back to the risks it treats.
- With IT and engineering: treatment actions land as tickets in their own queue, not in a separate spreadsheet.
- With the internal auditor: share the register to inform their plan, and expect them to test whether treatments did what the register claims.
- With procurement: vendor assessments that surface high-risk issues become entries in the register.
What to look for in risk tooling
Test whether a tool enforces one methodology across business units, stores inherent, residual, and target scores separately, links risks to the controls that mitigate them, and keeps history so you can show trends rather than snapshots. Asurvo's Risk Management module provides a register with inherent, residual, and target scoring, treatment plans with owners and deadlines, and heatmaps and trends. Its AI can build an initial risk assessment specific to your organization, which gives workshops a considered starting point instead of a blank page.