Three colleagues sit at a table, collaborating on a paper document that sits in front of one man holding a pen.
Emergency Management Jul 07, 2024

Risk Register Guide: How to Document and Monitor Risks

In business, risks can materialize unexpectedly, from regional conflicts disrupting supply chains to natural disasters compromising infrastructure. The risk register plays a crucial role in identifying and preparing for these unforeseen events.

Threat Assessment Template
Identify the threats that will have the biggest impact on your organization.
Headline text reading Threat Assessment Template with visual of three professionals looking at laptop

In business, risk lurks around every corner—some so subtle they barely register. As you plan, consider unexpected disruptions, like a regional conflict affecting supply chains or a natural disaster, such as a sinkhole swallowing key infrastructure. These events, often unforeseen and outside daily concerns, may be overlooked in a broad risk management plan.

The aptly named risk register serves as a critical tool to capture and prepare for such unforeseen risks. It ensures businesses can proactively mitigate their impact and maintain operational continuity with risk information in advance.

How a Risk Register Fits Into Risk Management

While the terms “risk register” and “risk management” are often used interchangeably, they’re two distinct components of an overall strategy.

What is a risk register?

The risk register serves as a specific tool for recording and tracking identified risks, focusing on documenting individual risks and associated details.

Risk register vs. risk matrix

Both risk registers and risk matrices assist leaders in prioritizing threats to the organization. However, the two tools are formatted differently. A risk register is a grid that identifies and tracks risks and related data, and the rows and columns are scalable depending on the team’s needs. A risk matrix stands out as a visual tool to help assess and compare risk priorities, typically based on the various risks’ likelihood and impact severity.

Risk register vs. risk management

In contrast, risk management entails a comprehensive approach to risk analysis, identification, and response. It involves strategic planning and ongoing monitoring, with responsibilities shared among various stakeholders. Documentation within risk management encompasses risk assessments, risk mitigation strategies, and monitoring reports. Below are a few differences between risk registers and management strategies.

Risk Register

Risk Management

  • Specific tool for recording and tracking identified risks.
  • Focuses on documenting individual risks and associated details.
  • Managed by designated individuals or team members.
  • Provides a centralized repository of identified risks.
  • Supports the implementation of risk management strategies.
  • Comprehensive approach to identifying, assessing, and responding to risks.
  • Involves a strategic action plan and ongoing monitoring.
  • Responsibility is shared among various stakeholders.
  • Documentation includes risk assessments, mitigation plans, and monitoring reports.
  • Proactively addresses risks to minimize their impact on objectives.

A risk register is a central component in your management strategy, but a lot of organizations don’t keep one. Without a detailed record of identified risks and their characteristics, it becomes difficult to effectively prioritize, monitor, and respond to potential threats. They also have benefits beyond risk management.

How Will a Risk Log Benefit Your Organization?

Typically, a risk register includes details such as the nature of possible risks, likelihood and potential impact, mitigation strategies, responsible parties, and status. By maintaining a comprehensive record of risks, organizations can proactively address challenges and capitalize on opportunities to achieve their goals effectively. In fact, there are multiple ways leaders can use these registers.

Compliance and regulatory requirements

Stakeholder communication and transparency

Strategic decision-making

Organizational resilience and adaptability

A comprehensive risk register helps organizations meet regulatory standards by identifying potential risks related to compliance issues and regulatory changes. This proactive approach allows organizations to take timely measures to address these risks and ensure compliance with legal requirements.A well-maintained risk register serves as a valuable communication tool for stakeholders, both internal and external. It provides transparency into the organization’s risk landscape, facilitates meaningful discussions about risk management strategies, and fosters trust among team members.By understanding potential risks across various aspects of operations, organizations can make informed decisions about investments, expansions, or changes in business direction.





Identifying and addressing potential threats before they escalate helps organizations adapt more effectively to changing circumstances and unforeseen challenges, thereby improving their ability to sustain long-term success.




Integrating a Register Into Your Risk Management Strategy

A risk register can be either organization-wide or project-based. A project risk register is a document specifically tailored to a particular project. A key component in project management, a register identifies, assesses, and manages risks that could impact successful delivery. This register typically includes risks related to project scope, schedule, budget, resources, and stakeholders. For example, if a project involves implementing a new software system, risks might include technical challenges, resource constraints, or changes in user requirements.

On the other hand, an organizational risk register is a broader document that encompasses risks across the entire organization. It identifies risks that could affect the achievement of the organization’s strategic objectives. These risks may include factors such as market conditions, regulatory changes, financial stability, cybersecurity threats, and reputational risks. Unlike a project risk register, which is temporary and specific to a project, an organizational risk register is ongoing and addresses risks that could impact the organization as a whole.

To illustrate how to create and maintain an organizational risk register, we’ll integrate insights from Lukas Quanstrom, CEO and Co-Founder of Ontic, shared during his appearance on The Employee Safety Podcast.

As the leader of a security technology company that provides a protective intelligence platform, Quanstrom emphasizes the importance of using advanced methodologies like risk management tools, workflows, and mitigation strategies to comprehensively identify and address risks across an organization. This approach ensures that all identified risks, whether related to cybersecurity, market fluctuations, or operational challenges, are meticulously documented with their respective risk status, mitigation plans, and ongoing tracking mechanisms.
Identify your business’ most critical threats with this fill-in-the-blank template.

Identify risks across sources

The first step in creating a risk register is identifying possible threats. These aren’t just the threats found in the business’s SWOT analysis or the known threats from historical data and previous experience. Most risks related to natural disasters, workplace violence, regulatory changes, and cybersecurity threats are known and documented.

But what about emerging threats? Small pieces of information can help make organizations aware of new risks.

In the AlertMedia podcast, Lukas Quanstrom describes these as “pre-incident threat indicators.” This involves gathering information from various sources, both internal and external. As Quanstrom noted, threats can manifest in numerous ways, such as “a threatening letter, a dark web post, or an employee tip.” This diversity of sources underscores the necessity of a broad and thorough approach to risk identification.

Here are some examples of pre-incident threat indicators that can help organizations monitor for emerging risks.

  • Threatening communications: Instances where the organization receives letters, emails, or social media posts containing threats or aggressive language.
  • Unusual employee behavior: Observations of sudden changes in behavior, increased absenteeism, or signs of distress or agitation among employees.
  • Suspicious activity: Instances of unexplained presence of unknown individuals around the workplace or employees accessing sensitive areas without valid reasons.
  • Dark web activity: Discovery of information related to the organization or its employees appearing on dark web forums or platforms.
  • Increased security incidents: An uptick in security breaches or attempts, such as unauthorized access or hacking incidents.
  • Vandalism or sabotage: Damage to property or equipment that appears deliberate in nature.
  • Anonymous tips: Information provided anonymously by employees or third parties regarding potential threats or concerning behaviors.
  • Changes in the external environment: Events such as political or social unrest, nearby incidents of violence, or shifts in regulatory environments that may impact organizational security.
  • Social media monitoring: Tracking posts or discussions on social media platforms that indicate discontent or plans for disruptive actions.

Any of these events may indicate that it’s time to include another risk on your register. The next step is to determine its likelihood.

Conduct a thorough risk assessment and analysis

The next stage in building a risk register is analyzing the severity of potential threats and their impact on the organization. This step is crucial for understanding the scope and severity of each risk, allowing organizations to prioritize mitigation efforts effectively by establishing risk categories. By employing professional threat assessment methodologies, organizations can systematically evaluate risks across various domains, ensuring thorough analysis and informed decision-making.

Some common risk analysis methodologies include:

  • WAVR-21: Workplace Assessment of Violence Risk – 21; assesses workplace violence risk across 21 key domains.
  • HCR-20: Historical, Clinical, Risk Management – 20; evaluates violence risk using historical, clinical, and risk management factors.
  • MOSAIC Threat Assessment System: Identifies and manages threats through analysis of fixation, communications, and behavior patterns.
  • J-SOAP-II: Joint Services Operational Assessment of Personality – II; assesses potential for violence based on personality traits and behaviors.
  • CARVER Matrix: Assesses criticality, accessibility, recoverability, vulnerability, effect, and recognizability of targets or threats.
  • VASt: Violence Risk Appraisal Guide; provides a structured assessment of violence risk factors and protective factors.
  • Sigma Threat Management Associates: Offers comprehensive threat assessment and management services focusing on violent or disruptive behaviors.
  • SWOT Analysis: Strengths, Weaknesses, Opportunities, Threats; strategic planning tool to assess internal and external factors impacting an organization.
  • Bowtie Risk Assessment: Visualizes hazards, threats, and controls in relation to risk exposure and mitigation strategies.
  • Failure Modes and Effects Analysis (FMEA): Identifies potential failures in systems or processes and assesses their impact and likelihood.
  • Probabilistic Risk Assessment (PRA): Quantitatively assesses risks by analyzing scenarios, probabilities, and potential consequences.

Incorporating professional threat assessment methodologies provides a structured approach to risk analysis. As Lukas Quanstrom emphasizes “Using these methodologies allows us to rigorously analyze risks and prioritize mitigation efforts effectively.” This structured analysis not only enhances the accuracy of risk assessments but also enables organizations to develop targeted strategies to mitigate identified risks proactively.

Document identified risks

Clear risk descriptions will help you understand the threat and plan accordingly. Using a risk register template can facilitate this process by incorporating specific details. This includes documenting the nature of the risk, its likelihood, potential impact, mitigation strategies, responsible parties, and current status. Detailed documentation ensures that all relevant stakeholders have access to a centralized repository of identified risks.

Quanstrom highlighted the role of technology in managing and analyzing large volumes of data related to these risks. Modern tools like threat intelligence platforms and risk management software provide robust capabilities for analyzing and managing large volumes of data related to identified risks. These technologies enable organizations to efficiently gather and assess information from various sources, facilitating proactive monitoring and mitigation strategies. By leveraging such tools, businesses can enhance their ability to identify emerging threats, allocate resources effectively, and maintain comprehensive documentation of risk management efforts. This systematic approach supports informed decision-making and fosters a culture of continuous improvement in organizational resilience.

Develop an accompanying response plan

The primary objective of a risk register is to systematically track various risks across an organization or project. However, it also serves as a foundational tool for creating proactive risk response strategies.

Each risk identified in the register, whether it pertains to team members, risk management processes, or specific risk events like security risks or market fluctuations, requires a meticulously tailored response plan. These plans delineate both qualitative and quantitative approaches to mitigate potential impacts. For instance, qualitative strategies may involve enhancing team training or implementing stricter access controls, while quantitative measures could include allocating additional resources to address the potential threat.

Assigning risk owners responsible for overseeing these response actions is critical for accountability and timely implementation. This ensures actions are well-coordinated and aligned with organizational goals.

2024 Threat Outlook Report
Get expert insights on the critical events that shaped 2024 to better protect and prepare your business in the year ahead.
Get the Report

Continuously monitor and review risks

As risks themselves are dynamic, a risk register is a dynamic tool that requires continuous updates to effectively track risks and their evolving nature. Regular reviews are essential to assess risk priority, probability, and score, ensuring that the register accurately reflects current threats and their potential impacts. This ongoing monitoring process incorporates new information and changes in circumstances, enabling organizations to streamline risk management efforts and maintain relevance in their mitigation strategies.

Engaging stakeholders throughout this process is crucial for comprehensive risk management. By involving key personnel, organizations can leverage diverse perspectives to describe specific risks, identify security risks, and streamline risk assessment processes. This collaborative approach fosters a shared understanding of organizational vulnerabilities and promotes proactive measures to mitigate potential threats.

Lukas Quanstrom emphasizes the significance of proactive monitoring, stating, “Adopting a proactive, always-on security approach allows organizations to anticipate and address emerging threats before they escalate.” This proactive stance ensures continuous improvement in risk identification and mitigation.

A Template for Strategic Risk Management

The best risk register examples are built on structured frameworks that facilitate comprehensive risk identification, assessment, and management. They incorporate clear categorization of risks, systematic evaluation of likelihood and impact, and robust mitigation strategies tailored to specific threats. Additionally, effective risk registers prioritize regular updates and stakeholder engagement to ensure alignment with organizational goals and evolving challenges. By adhering to these principles, organizations can cultivate a proactive approach to risk management, enhancing resilience and maximizing opportunities for success.

Maintaining a comprehensive risk register helps organizations establish a proactive foundation for their risk management strategies. By knowing what threats are potentially ahead, organizations can anticipate challenges, allocate resources effectively, and implement timely mitigation measures. This proactive approach not only enhances preparedness but also fosters resilience, enabling organizations to navigate uncertainties with confidence and achieve their strategic objectives securely.

Do you need to identify the threats facing your organization? Download our threat assessment template to get started.

Threat Assessment Template

Please complete the form below to receive this resource.

Like What You're Reading?
Subscribe to Our Newsletter
Subscribe to The Signal by AlertMedia to get updated when we publish new content and receive actionable insights on what’s working right now in emergency preparedness.

Cookies are required to play this video.

Click the blue shield icon on the bottom left of your screen to edit your cookie preferences.

Cookie Notice