6.5.1.1 Risk Register

Risk Register

A risk register is one of the most common tools for tracking and managing risks within an agency, since it provides a framework for capturing critical information about each risk, its importance to the agency, mitigation plans and tracking and managing responsibilities. A risk register is typically generated as a spreadsheet, though other formats are available. An example of a comprehensive risk register, which includes assignments for risk mitigation strategies, is presented in Figure 6.5. Over time, columns may be added to indicate when the risk information was last updated, what further action is required and whether adequate progress is being made towards the mitigation strategy.

A risk register should be reviewed at least quarterly to evaluate whether the risk register or the risk management plan for any of the performance areas needs to be updated. Periodic changes to the risk profile may be obtained through executive staff meetings meant to evaluate progress regularly, or ongoing reports tracking risk mitigation efforts and results. Annually, the agency may determine whether any strategic-level risks should be adjusted based on evaluation of the agency’s performance and the risk reports provided by the risk owners.