Skip to main content
OpsRoadmaps

Checklists / risk-register-review

Risk Register Review Checklist

A quarterly review that keeps the risk register a decision tool rather than a document — owners, treatments, acceptance, and honest closure.

8 steps · 7 required · last reviewed (next review 2027-03-20) · updated 2026-09-20

Related focus areas:GRCOps

Roadmaps covering the same ground:AWS Security ImprovementDevSecOps RolloutResilience and DR Improvement

Sign in to run this checklist

A risk register decays in a predictable way: entries are added, nothing is ever closed, scores never change, and within a year it is a document that exists to be shown rather than used. This review is the maintenance that prevents that.

Bring the register and the last quarter's incidents to the same meeting. Any incident that had no corresponding risk entry is the most useful finding you will get.

  1. Every open risk has a named individual owner, not a team or a function

    required

    A risk owned by "Engineering" is owned by nobody. Accountability needs a person who can be asked.

  2. Each risk states its treatment decision: mitigate, transfer, avoid, or accept

    required

    Undecided risks are accepted by default, without anyone having chosen to accept them.

  3. Accepted risks have an explicit accepter with the authority to accept them and a review date

    required

    Acceptance without authority is just a note. Acceptance without a date is permanent by accident.

  4. Scores were revisited this quarter, and some of them changed

    required

    If no score ever moves, the scoring is decorative. Changing conditions must move numbers.

  5. Last quarter's incidents are reconciled against the register

    required

    An incident with no corresponding risk means the register is missing a class of thing you actually face.

  6. Risks with completed treatments are closed, with the evidence of completion linked

    required

    Closure is how the register stays short enough to read.

  7. The register distinguishes inherent from residual risk where treatments exist

    required

    Reporting only inherent risk hides the value of the work; reporting only residual hides the exposure if it lapses.

  8. Top risks map to something in the current engineering plan

    optional

    A top risk that no one is funded to reduce is a statement of intent, not a plan.

Run it against your real gaps

A checklist is most useful when you know which controls you are actually missing. A free OpsRoadmaps assessment scores your controls with explainable findings and builds a roadmap from the results.

Assess my stack

Checklists document self-reported practice. Items were last reviewed 2026-09-20 — adapt them to your own environment.