Risk Registers Don't Manage Risk

Most organisations have risk registers.

Many assume this means they manage risk effectively.

It does not.

A risk register is simply a list.

Risk management begins when leaders use that information to make decisions.

The true test is not whether a risk appears on a register.

The true test is whether the organisation understands:

• The likelihood.

• The impact.

• The drivers.

• The controls.

• The response.

Risk registers record risk.

Decisions manage risk.