Skip to content

Risk Register

What is Risk Register?

A documented inventory of identified risks, their assessments, treatment plans, and current status. A key tool in enterprise risk management.

Risk Management

Related terms

Risk AssessmentRisk Treatment

Frameworks that govern risk register

NIST Cybersecurity Framework 2.0View framework →ISO 27001:2022View framework →

What the standards actually require on risk register

Requirements naming risk register across 6 standards, quoted from the control text.

IRM Enterprise Risk Management Framework (Institute of Risk Management)5 controls

Risk Reporting + KRIs + Performance + Horizon Scanning translate the risk management process into actionable management information.

IRM-Reporting-KRIs-Performance-HorizonScanning-Dashboard-Heatmap-RiskRegister-EmergingRisk · IRM Risk Reporting + Key Risk Indicators (KRIs) + Performance Measurement + Horizon Scanning + Dashboard + Heat Map + Risk Register + Emerging Risk Identification →
NIST SP 800-304 controls

Communicate risk per NIST SP 800-30 Rev 1 Section 3.3 Step 7 (Communicating and Sharing Risk Assessment Information). Communication must address (a) decision makers (system owner, mission owner, authorising official, Risk Executive Function, board) with approp...

NISTSP30-7 · Risk Communication and Sharing →
Monetary Authority of Singapore Technology Risk Management Guidelines2 controls

Implement Technology Risk Governance + Technology Risk Management Framework + Information Asset Management per MAS TRM Chapters 2 + 3 + 5.

MAS-TRM-Governance-Chapters-2-3-Board-Senior-Management-Risk-Framework-Information-Asset-Management · MAS TRM Governance + Chapters 2-3 + Board + Senior Management + Risk Framework + Information Asset Management →
Automotive SPICE (ASPICE) v4.0 - Process Assessment Model1 control

Identify, analyse, and treat project risks throughout the lifecycle with documented risk register and mitigation tracking.

MAN.5 · Risk Management →
HKMA Cyber Resilience Assessment Framework (C-RAF)1 control

HKMA C-RAF Domain 1 GOVERNANCE + Domain 2 IDENTIFICATION. DOMAIN 1 GOVERNANCE (5 sub-areas): (1) CYBER RISK GOVERNANCE - board + senior management oversight + governance structure + reporting lines + delegation; board cyber-risk literacy + training;

HKMA-CRAF-Domain1-2-Governance-Identification · HKMA C-RAF Domain 1 (Governance) + Domain 2 (Identification) - Cyber Strategy, Risk Management, Asset Management, Threat Assessment →
IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems1 control

UR E26 Goal 1 (Identify) also requires a Ship Cyber Resilience Plan (SCRP) covering scope + assumptions + roles + responsibilities + risk assessment methodology + control measures + maintenance procedures + incident response + recovery + training.

IACS-UR-E26-Identify-Plan-Risk-Survey-Documentation · IACS UR E26 Identify Goal - Ship Cyber Resilience Plan + CBS Risk Assessment + Survey + Documentation →

Questions people ask about risk register

What is Risk Register?
A documented inventory of identified risks, their assessments, treatment plans, and current status. A key tool in enterprise risk management.
Why is Risk Register important for compliance?
Risk Register is a key concept in Risk Management. Understanding risk register helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
What concepts are related to Risk Register?
Key concepts related to Risk Register include Risk Assessment, Risk Treatment. Understanding these interconnected concepts provides a more comprehensive view of Risk Management requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Risk Register?
Risk Register appears in the requirement text of IRM Enterprise Risk Management Framework (Institute of Risk Management), NIST SP 800-30, Monetary Authority of Singapore Technology Risk Management Guidelines, Automotive SPICE (ASPICE) v4.0 - Process Assessment Model, HKMA Cyber Resilience Assessment Framework (C-RAF). Across these standards we have identified 14 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Risk Register?
Explore our compliance framework pages to see how risk register applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Risk Register applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.