DerpGRC

    Topics in this domain

    Creating and Maintaining the IT Risk Register

    Risk register · 1 min read

    What a register holds

    Register fields: ID and scenario, owner, inherent rating, existing controls, residual rating, treatment and actions, status and review date.

    Who does what

    RoleRegister responsibility
    Risk practitionerMaintains its structure, quality and consistency
    Risk ownerKeeps their entries accurate; approves responses
    Control and action ownersUpdate action status
    Senior managementReviews top risks and trends

    One consistent register, linked to the enterprise register, beats many local spreadsheets with different scales.

    Keeping it current

    Reassess on new threats, business change, technology change, incidents, KRI breaches, regulation and supplier change.

    Quality checks

    • Every entry has a named owner and a review date.
    • Scenarios are specific, not one-word labels.
    • Ratings use the common scales.
    • Accepted risks show who accepted them and until when.

    Example. A register review finds 30% of entries with no owner and 15 risks still open for systems retired last year. Cleaning it up and assigning owners cuts the active list by a quarter and makes the top risks clear.

    How the exam asks about it

    If the question asks…The answer is usually…
    PRIMARY purpose of the risk registerRecord and track risks, owners and responses
    When to update itContinuously, on change and new information
    Accepted riskKeep it on record with acceptance details and a review date
    Many local registersConsolidate into one consistent register

    In short

    • The risk register records each risk with its owner, ratings, controls, response, actions and status.
    • One consistent register, linked to the enterprise register, beats many local spreadsheets.
    • The risk practitioner maintains the register; owners keep their entries accurate.
    • Update it on change, incidents, audit findings, KRI breaches and completed actions, not just once a year.
    • Closed and accepted risks stay on record with their decisions and review dates.

    Exam traps

    • Letting each department keep its own register with different scales.
    • Updating the register only before audits.
    • Deleting accepted risks instead of recording the acceptance.
    • Entries with no named owner or review date.

    Slides

    Click the slide and use the arrow keys. F toggles full screen.

    CRISC · Domain 2 · Risk register

    Creating and Maintaining the IT Risk Register

    What goes into an IT risk register, who maintains it, how to keep it accurate and current, and why one consistent register is the backbone of IT risk management.

    1 / 8