A risk register is the documented collection of the risks identified in a project, each with an assessment, a planned measure and a named owner. It is the central instrument of risk management and at the same time one of the most frequently misused.
What an entry must contain
A usable entry describes five things. The risk itself, worded as a possible occurrence rather than a state — not "unclear requirements" but "if requirements remain unclear by the deadline, delivery slips by weeks". The likelihood of occurrence. The impact if it occurs. The planned measure. And a named person who is responsible. Without the last point the entry is an observation, not a measure.
Assessment by likelihood and impact
The conventional assessment combines likelihood and impact into a priority. More important than a fine scale is consistency: if different people assess with different severity, the prioritisation is worthless. A coarse three-point scale everyone applies identically beats a fine one everyone interprets differently.
The four responses
For every risk there are four basic routes. Avoid, by changing the approach so the risk disappears. Reduce, by lowering likelihood or impact. Transfer, contractually or through insurance. And accept, where the cost of the measure exceeds the risk. Accepting is a legitimate decision as long as it is taken deliberately and documented — that is exactly what distinguishes it from ignoring.
Why unmaintained registers do harm
A register created at project start and never touched again is worse than none. It creates the impression that risks are being handled, while the problems that actually materialised usually are not in it at all. The value arises exclusively from regular review: is the risk still current, has the assessment changed, is the measure working, have new risks appeared?
How it differs from an issue log
A risk is something that may occur. An issue is something that has occurred. The two belong tracked separately, because they are handled differently: risks are assessed and monitored, issues are resolved. A register mixing both quickly loses sight of what could still be prevented.
Practical consequence
A register with ten seriously maintained entries is far superior to one with fifty filed ones. The effort lies not in creating it but in the recurring review — and that is exactly what decides whether the instrument works or merely exists.