5.1 Risk recording

As discussed in Session 3, it is common for risks to be recorded in a risk register. A risk register can be captured in a variety of ways ranging from a piece of paper to a purpose-built IT system. Irrespective of the tool used the information captured is the same.

In large organisations there may be many risk registers. Risks from higher-level registers may be flowed down to lower-level registers and risks from lower-level registers may flow up to higher-level registers (normally due to their level of impact). This can mean that certain risks can ‘appear’ on more than one risk register, either in their own right (because of their potential impact) or as broader ‘aggregated risk’.