A governance and risk concept defining structures and practices used to oversee decisions and manage organizational exposure. It specifies roles, controls, policies, and monitoring activities that reduce legal, financial, and operational surprises. It does not remove risk and requires effective accountability, testing, and remediation to remain effective. It supports resilience and trust by aligning decision authority with oversight and by ensuring obligations are met. The concept is generally stable, though regulatory expectations and organizational practices evolve over time.

Principle

Make risk explicit, assign accountability, document agreed responses and track status so potential threats and opportunities are visible and acted upon before they materialize or escalate.

Demonstration

An IT project risk register lists a cybersecurity vulnerability with likelihood 'medium', impact 'high', owner assigned to the security lead, mitigation steps (patching schedule, penetration test) and a review date for status updates.

Misapplication

Using a risk register as a static annex filed away or recording only problems after they occur (turning it into an issue log) rather than updating it as a forward-looking control tool with owners and actions.

Consequence

A maintained risk register promotes early mitigation, clarifies ownership, supports informed decisions about contingencies and budgets, and enables trend monitoring across review cycles.

Reversal

Issue log — records realized problems and corrective actions after occurrence but does not systematically capture unmaterialized threats or owners for proactive mitigation.

Boundary

Documents identified risks and planned responses but does not by itself perform quantitative Monte Carlo analysis or replace formal insurance underwriting and enterprise risk models; it should integrate with other risk and governance tools.

Semantic Tension

Overlap with issue logs, RAID logs and risk registers in naming; tension arises when teams conflate risks (possible events) with issues (realized events) or omit owners and contingency triggers.

Synthesis

The risk register is the operational repository that captures potential events, evaluates their significance, assigns ownership and records the response plan and status, enabling proactive and auditable risk governance.