The Risk Register Is Where Good Intentions Go to Die
Every security program I have inherited comes with one: a spreadsheet, dozens of rows, colour-coded, an “owner” column, a “target date” column mostly populated with dates that have already passed. It is handed to me as evidence of maturity. It is usually the opposite — a graveyard where risks go to be recorded instead of resolved.
The risk register is one of the most comforting artifacts in security, and comfort is exactly the problem. Writing a risk down feels like doing something about it. It isn’t.
Logging a risk is not managing it
The moment a risk lands on the register, a quiet fiction takes hold: it is now “tracked.” Everyone can point to the row. The auditor sees it. The committee reviewed it. And nothing happens, because being written down was never the same as being owned. Over a year the register grows, the dates slip, the colours stay amber, and the document becomes an archive of things everyone agreed were bad and no one was funded to fix.
A register full of stale rows isn’t a sign you’re on top of risk. It’s a paper trail proving you saw the problem coming and did nothing — the single most damaging document to have in discovery after an incident.
A register is a queue, not a museum
Healthy risk management has motion. A risk should be moving toward one of four ends: accepted on purpose, mitigated, transferred, or actively being worked — each with a real owner and a date that means something. If a row has sat in the same state for two quarters, it is not a risk being managed. It is a decision nobody is willing to make, wearing the costume of a task.
The most useful thing I ever did to a risk register was make it short. Not because the risks went away, but because I forced every row to answer one question: what decision is this waiting on, and who owes it? Rows that couldn’t answer weren’t risks. They were anxieties.
Make the register force choices, not store them
Review it by exception, not by recital. Nobody learns anything from reading sixty rows aloud. Ask two questions instead: what changed since last time, and what decision is now due? The rest can wait. And when a risk has been accepted, say so out loud, with a name attached and a review date — acceptance is a legitimate outcome, but only if someone with the authority to accept it actually did.
Then do the uncomfortable part: close the dead rows honestly. Either the risk is real and someone owns the decision, or it isn’t and it comes off the list. A register that forces a handful of real choices every quarter is worth more than one that catalogues a hundred you’ll never make.
The register is not the work. The decisions are. Keep the spreadsheet short enough that it can’t hide them.