Like them or loathe them, risk registers are an unavoidable fact of life in many organizations. Regulators demand them, auditors check for them, even customers are asking for them.

All around the world people are being given forms and asked to fill them in. Whether this involves a group meeting or just filling in screens on a database the work boils down to filling in boxes in a table

The purpose of this series of studies is to describe what happens in practice when people fill in those boxes, and find some opportunities for improvement.

Research data source

The research is based on a collection of risk registers gathered by Googling the Internet for 'risk register' and related terms, then downloading all the registers and instruction/explanation documents found until an adequate number had been gathered.

This is not a 'sample' of risk registers because they were not selected by any kind of random method and risk registers for publication are unlikely to be representative of all risk registers. Almost all published risk registers are from the public sector and most are quite short.

Nevertheless the collection of risk registers shows interesting variations and the phrasing of risk items seems typical of unpublished risk registers I have seen.

As the studies continue the collection will grow.

About the author: Matthew Leitch is an independent consultant, researcher, and author specialising in internal control and risk management. He is a Chartered Accountant with a degree in psychology whose past career includes software development, marketing, auditing, accounting, and consulting. He spent 7 years as a controls specialist with PricewaterhouseCoopers, where he pioneered new methods for designing internal control systems for large scale business and financial processes, through projects for internationally known clients.