A risk register is a single list of the risks a business has identified, with an owner, a score, the controls in place and what is being done about each one. Build it in six steps: list the risks, name an owner, score them, record the controls, decide the response, and set a review date. A register that is not reviewed on a fixed date is just a list.
Last reviewed: 17 October 2026. Facts checked. We searched for common risk register column sets and found that vendor guides and a summary of NIST IR 8286 agree on the core fields, and that ISO 31000 describes the risk process without fixing the columns. We did not open the ISO 31000 or NIST documents themselves. The example rows below are illustrations, not data from any real company.
What a risk register is for
A risk register answers three questions for the board and for the audit team. What can go wrong? How bad is it, and how likely? Who is dealing with it?
It also feeds other work. An internal auditor uses it to decide where to spend audit days. A risk assessment matrix turns each row into a score. The register is the list; the matrix is the scoring method.
The columns to keep
Keep the sheet short. Every extra column is one more thing nobody updates.
| Column | What goes in it |
|---|---|
| Risk ID | A short code, such as R-01 |
| Description | One sentence: cause, event, effect |
| Category | Financial, operational, compliance, IT, fraud, people |
| Risk owner | One named person, not a department |
| Likelihood and impact | Each scored on your 1 to 5 scale |
| Inherent rating | Score before controls |
| Existing controls | What already reduces the risk |
| Residual rating | Score after controls |
| Response | Avoid, reduce, transfer or accept |
| Action, action owner, due date | The next concrete step |
| Status and last reviewed | Open, in progress, closed, and a date |
The four responses are the standard risk treatment options: avoid the risk, reduce it, transfer or share it (for example, insurance), or accept it knowingly. Scoring each risk twice, before and after controls, shows how much the controls are really worth.
Six steps to build it
- Collect risks from several places. Interview process owners, read last year's audit reports, review incident logs and look at the business plan. One workshop with the finance head alone will miss operations and IT.
- Write each risk as cause, event, effect. "Manual vendor master changes (cause) lead to a fake vendor being paid (event), causing cash loss (effect)." This is clearer than "fraud risk".
- Give each risk one owner. The owner is the person who can act on it. Separate the risk owner from the person who carries out the action if they differ.
- Score it. Use the same scales for every row. Define what a 3 means for likelihood and for impact before scoring starts.
- Record controls and score again. Write the control in a way an auditor could test it: who does what, how often, with what evidence.
- Decide the response and the date. A risk above your tolerance line needs an action and a due date. A risk you accept needs a named person who accepted it.
Six example rows
These are illustrative rows for a mid-sized Indian manufacturing company. The scores use a 1 to 5 scale, multiplied.
| ID | Risk | Owner | Inherent L x I | Key control | Residual L x I | Response |
|---|---|---|---|---|---|---|
| R-01 | Duplicate vendor payment from invoice entered twice | Finance controller | 4 x 3 = 12 | System duplicate check on vendor and invoice number | 2 x 3 = 6 | Reduce |
| R-02 | Fake vendor created through unreviewed master data change | Head of procurement | 3 x 4 = 12 | Monthly review of vendor master changes by someone outside procurement | 2 x 4 = 8 | Reduce |
| R-03 | Late statutory filings from missed due dates | Company secretary | 3 x 3 = 9 | Compliance calendar with maintainer and reviewer | 2 x 2 = 4 | Reduce |
| R-04 | Key ERP user holds both create and approve rights | IT head | 3 x 4 = 12 | Quarterly user access review | 2 x 3 = 6 | Reduce |
| R-05 | Stock count differences not investigated | Plant manager | 4 x 3 = 12 | Cycle counts with variance sign-off | 3 x 2 = 6 | Reduce |
| R-06 | Personal data leaked from an unprotected customer file | Data protection lead | 3 x 5 = 15 | Access controls and encryption on the customer database | 2 x 4 = 8 | Reduce |
Notice that no row is simply "monitored". Each has a control someone can test and a score that falls after the control is applied.
Mistakes to avoid
- Too many risks. Thirty well-run rows beat three hundred ignored ones.
- Generic wording. "Cyber risk" cannot be owned or tested.
- No residual score. Without it, you cannot tell whether controls are working.
- Owner is a department. Departments do not act. People do.
- Never reviewed. Put review dates in the calendar when you build the sheet.
How internal audit uses the register
Internal audit does not own the register. Management does. Audit reads it to build the audit plan, checks whether the controls named in the register really operate, and reports where the residual score looks too optimistic. If you are building an audit plan from it, our guide to building an audit universe shows the next step. To turn register rows into testable controls, see key controls examples with RCM rows.
If you want a quick starting score, the internal audit risk scorer on our site can help you rank areas before you fill in the sheet.
Frequently Asked Questions
What is the difference between a risk register and a risk matrix?
The register is the full list with owners, controls and actions. The matrix is the grid you use to score likelihood and impact for each row. You need both.
How many risks should a register have?
There is no fixed number. Keep only risks that someone owns and will act on. A short register that is reviewed is more useful than a long one that is not.
Who should own the risk register?
Management owns it, usually through a risk or finance head. Internal audit reviews it and uses it for planning but should not own it, because that would mean auditing its own work.
How often should we update it?
Set a review date for every row. Many teams review quarterly, and review sooner after a major incident, a new system or a change in law. Choose a rhythm you can keep.
Do we need special software?
No. A spreadsheet with the columns above is enough for most small and mid-sized businesses. Move to software when the number of owners and reviews makes a spreadsheet hard to control.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error