What is a risk register?

An ISMS risk register is a way to categorise information security risks and forms the backbone of a successful information security management system (ISMS).

A risk register includes a set of risks; each given a risk score; a method of dealing with the risk; and a risk owner within the organisation. Risks are tracked on an ongoing basis by an organisation’s management team in review meetings.

A risk register documents how your organisation has dealt with risk over time and; hopefully; how risk has been reduced through this process.

For ISO 27001 compliance; a risk register is a mandatory document; so critical for businesses to create.

Risk register essentials

An ISMS risk register categorises information security risks and forms the backbone of a successful ISMS.
Each risk carries a risk score, a method of dealing with it, and a risk owner within the organisation.
Risks are tracked on an ongoing basis by the management team in review meetings.
For ISO 27001 compliance, a risk register is a mandatory document.

ISMS Risk Register Template

The following considerations should be included in your risk register; and can be used as a starting point or template for creating your own risk register. It’s worth noting that this is not an extensive and all-encompassing risk; there may be industry- or organisation-specific factors that you have to consider; but this is a good starting point.

Your risk register should contain the following:

Field	What it captures
Risk name	This should be clear and not create any doubt or overlap with other risks.
Risk description	The description should provide a succinct and clear definition of the risk; pitched at a level relevant to the management team reviewing it.
Risk likelihood	All organisations have risks; either internal or external; so this should provide a realistic estimate of the risk’s likelihood of occurring. You can use a 1-5 scale for this.
Risk impact	This section concerns the level of impact on your organisation; should the risk occur. Again; you can use a 1-5 scale for this.
Risk controls	What controls are currently in place to prevent the risk; or to mitigate the risk; should it occur.
Risk owner	Who; within the management team or wider organisation; is responsible for this risk?
Risk status	This should cover the current status of this risk on an ongoing basis.

As well as considering these factors; organisations can also use a risk matrix tool; which plots the likelihood of a risk occurring (point 3 above) against its impact (point 4 above).

In a matrix like this; risks are categorised on a sliding scale as follows:

Impact	Likelihood	Priority
Low impact	Low likelihood	Low-priority
Low impact	High likelihood	Medium-priority
High impact	Low likelihood	Medium-priority
High impact	High likelihood	High-priority

Scoring and prioritising risks

Score each risk for likelihood and impact on a 1-5 scale.
A risk matrix plots likelihood against impact to sort risks into low, medium and high priority.
Capture seven fields per risk: name, description, likelihood, impact, controls, owner and status.
Keep the register in a simple format such as an Excel spreadsheet, with each risk on its own row.

ISMS Risk Register Example

In practical terms; an Excel spreadsheet is a perfect format to create and maintain a risk register. Organisations should assign columns for the seven categories listed above; with each risk occupying a separate row.

To effectively maintain a risk register; management should use this risk register document to consistently review the organisation’s information security risks; updating it on an ongoing basis and using it to track how you have dealt with the risks identified.

To learn more about ISMS and ISO 27001 implementation with Hicomply; read about the Top 10 Benefits of Implementing An ISMS or ISO 27001.

What Hicomply recommends

A risk register only reduces risk if it stays alive - the biggest gains come when teams review and update it continuously rather than dusting off a spreadsheet once a year. Instead of tracking risks, owners and controls across disconnected files, a platform tour shows how an automated ISMS keeps your register, scores and evidence audit-ready in one place.