What is a risk register and how to use one
The risk register is the central artefact of a GRC function. It is the organisation's written record of what it knows could go wrong, who owns each of those things, and what it has decided to do. A well-kept register is the single most useful document a security team produces.
What this session covers
- A risk statement should name the cause, the event and the consequence — not just a topic. 'Phishing' is not a risk; 'an employee is deceived into transferring funds to a fraudulent account, resulting in financial loss' is.
- Record inherent and residual risk separately, so the value of your controls is visible.
- Every entry needs a named owner — a person, not a department.
- Record the treatment decision and its rationale, including for accepted risks.
- Set review dates and honour them. An unreviewed register becomes fiction within a year.
Registers decay in predictable ways. They grow until nobody reads them, entries are written so vaguely that no action is possible, and ownership sits with a team rather than a person so nothing moves.
The discipline that prevents this is ruthless: fewer, clearer entries, each with a person's name against it and a date by which something will have changed.
Go further with mentorship
This session is part of our free twelve-week GRC series. If you want structured, mentor-led support to turn this into a job-ready skill set, the LSCS GRC Mentorship programme runs over six months with live sessions, real case studies and interview preparation.