What is Risk Register?
The living record of what could go wrong, how bad it would be, who owns it, and what you are doing about it.
Risk Register: definition
You cannot manage risk you have not written down. A risk register catalogs identified risks and, for each, assesses likelihood and impact, assigns an owner, and records the mitigation or treatment and its status. It is central to frameworks like ISO 27001, which require a documented, risk-based approach, and it turns risk management from vague worry into a tracked, accountable process.
- Catalogs risks with likelihood, impact, owner, and mitigation
- Tracks treatment status over time - a living document
- Required for risk-based frameworks like ISO 27001
- Turns risk from abstract concern into accountable action
How Fintra handles it
Fintra maintains a live risk register within its compliance layer, linked to the controls that mitigate each risk and the evidence that they operate. Because risks connect to controls and controls to evidence, the register is not a stale spreadsheet - it reflects the current state, and remediation of a control gap updates the associated risk automatically.
Worked example
| Risk | Likelihood / Impact | Owner | Mitigation |
|---|---|---|---|
| Unauthorized payment by AI agent | Low / High | Controller | Approval threshold + logging |
| Lost EU data residency | Low / High | Security | In-region hosting + audit |
| Stale access after offboarding | Medium / Medium | IT | Automated access review |
Frequently asked questions
What goes in a risk register?
Each identified risk with an assessment of its likelihood and impact, an assigned owner, the mitigation or treatment in place, and its current status. Some registers also track residual risk after mitigation and links to the controls that address the risk.
Why is a risk register important?
It makes risk explicit, owned, and tracked rather than a vague concern. Frameworks like ISO 27001 require a documented, risk-based approach, and a register is how you demonstrate you have identified, assessed, and are treating your risks.
How often should a risk register be updated?
It is a living document - reviewed regularly and whenever the environment changes (new systems, incidents, or business shifts). A register that is only touched annually quickly goes stale. Linking risks to live controls, as Fintra does, keeps it current.
How does Fintra support a risk register?
Fintra maintains a live risk register linked to the controls that mitigate each risk and the evidence they operate, so the register reflects current state and updates as control gaps are remediated - not a static spreadsheet.
Stay in the loop
One practical finance briefing a week - new guides, checklists, and benchmarks.
See how Fintra handles the numbers behind this term
Fintra is the AI Finance Operating System for SMBs - accounting, planning, payroll, equity, and AI governance on one shared data model, with a named human approving anything consequential. Free to start, no card required.
Talk to us