Risk register
The risk register is the list of one entity’s risks. Each risk carries its category, owner, cause, controls, treatment and status, and a risk code that the system issues.
Who may do it: a Risk Champion adds and edits the risks of their own team; the Entity Risk Manager works on the whole entity’s register. Everyone else reads the register within their own scope. See Roles and permissions.
The register belongs to one entity. You see and work on the register of the entity where your role is granted. If you hold roles in several companies of your group, switch company from the header.
What a risk carries
Section titled “What a risk carries”| Field | What it holds |
|---|---|
| Risk code | Issued by the system when the risk is first saved, in the format CM-RISK-2026-001. It cannot be typed or changed. |
| Risk category | One of the 8 standard categories in the group’s risk taxonomy: Strategic · Credit · Market · Liquidity · Operational · Compliance & Legal · Technology & Cyber · Reputational — see Risk taxonomy and RACI |
| Owner | The person accountable for the risk |
| Cause | What could make the risk happen |
| Controls | The controls that reduce the risk — see Controls and control testing |
| Treatment | How the entity responds to the risk |
| Status | Where the risk stands in its life cycle |
Adding a risk
Section titled “Adding a risk”- Open your entity’s risk register.
- Start a new risk and choose its Risk category.
- Describe the risk and its cause.
- Name the owner.
- Record the controls already in place.
- Choose the treatment.
- Save. The system issues the risk code and records you as the author, with the time.
- Score the risk — see Scoring a risk.
What the system does or refuses
Section titled “What the system does or refuses”- Issues the risk code. There is no field to type one. See Computed, never typed.
- Records who and when on the new risk and on every later change. See Who-filed is stamped.
- Refuses changes after submission. Once the filing that holds the risk is submitted, the risk is locked until the filing is returned or reopened — see Submission and sign-off.
- Refuses changes from outside the entity. A user whose role is granted at a parent entity reads the register and cannot add or edit risks. See Subsidiary-Independence.
- Shows an empty register as empty. A new entity with no risks yet sees a clear empty state.
Related
Section titled “Related”- Scoring a risk
- Recording a loss event — each loss event is tied to a risk in this register
- Reporting periods and roll-forward — how the register moves into the next cycle