Definition
A risk register is a central document used to track and manage potential threats to an organization's assets, systems, or projects. It typically includes details about each identified risk, such as its description, likelihood of occurrence, potential impact, and proposed mitigation strategies. This living document acts as a roadmap for proactive risk management, enabling teams to prioritize and address threats before they materialize. By maintaining a risk register, organizations can make informed decisions about resource allocation and implement appropriate controls to safeguard their operations. For instance, a software development team might log a risk of a critical bug in a new feature, detailing the potential for customer dissatisfaction and outlining a plan for extensive testing. This differs from a simple issue log, which typically tracks problems that have already occurred rather than potential future events. The concept of a risk register is fundamental in domains like project management, cybersecurity, and enterprise risk management, appearing on exams such as PMP, CISSP, and Security+.