What Goes in the Register?

About this interactive

Once risks are identified, the Risk Tracking & Risk Register lesson tracks each one through its life cycle in a risk register: a spreadsheet or a database with one line per risk. Risk description: what could happen, and to which asset. "Sales laptops holding customer data could be stolen from cars." The demo also gives each risk an ID and the ID of the asset at stake, so other worksheets can refer to it. Risk owner: the one person responsible for the risk. The owner sees it through assessment and mitigation and takes accountability for what happens to it. Likelihood and impact: the measurement of the risk, as ratings (likely, major; or 4 and 4 on a 1 to 5 scale) or, in quantitative analysis, a probability and a dollar impact. Priority: the list gets long, so each risk is scored and compared with the rest. The demo shows a risk level and a weighting against every other risk; the highest is tackled first. Treatment: the response chosen for the risk, the solution or control that will mitigate it (or the decision to avoid, transfer or accept it). A quick test for each entry: does it say what could happen, who answers for it, how big it is, where it ranks, or what is being done?

What you'll learn

Place each entry of a new risk register line in the field that holds it: the risk description, the risk owner, the likelihood and impact rating, the priority, or the treatment
Explain what each field is for: the description says what could happen to which asset, the owner is accountable until the risk is dealt with, likelihood and impact measure it, the priority ranks it against the other risks, and the treatment records the response

Aligned to

CompTIA Security+

5.2 Explain elements of the risk management process.

ISC2 CISSP

1.9 Understand and apply risk management concepts

Key terms

Risk Register: A centralized document or database that tracks identified risks, their likelihood, potential impact, assigned owners, and planned response actions. The risk register is a core artifact of an organization's risk management program.
Risk Owner: The individual accountable for monitoring and managing a specific risk through its assessment, treatment, and review process.
Risk Treatment: The selected response or control implemented to mitigate, transfer, accept, or eliminate an identified risk.
Likelihood: A descriptive rating used in qualitative risk analysis to estimate how probable it is that a risk event will occur, typically expressed as low, medium, or high.
Impact: The potential consequence or damage to an organization if a risk event occurs, expressed qualitatively or as a monetary value.
Risk Score: A calculated value derived from multiplying or combining probability and impact ratings to quantify the overall level of a risk.

Topics

Risk Management Risk Register Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →