Why risk registers go stale

A risk register goes stale when nobody owns the actions in it.

1 min read

The register becomes a compliance task

Many registers are updated once a year because an audit or board cycle requires it. Risks change faster than that. By the time the register is reviewed, some entries no longer match how the business operates.

Owners are named but actions are not

A named risk owner is a start. The register stays current when each risk also has a specific action, a due date and a person responsible for it. Open actions give people a reason to return to the register.

Link the register to decisions

Bring the register into budget, project and strategy discussions. When leaders use it to make decisions, out-of-date entries get noticed and corrected.

Keep reading

More guides

After the refineries: how South Africa’s fuel business makes money going into 2027South Africa now imports more than half its fuel, runs two refineries and loses its Mozambican gas supply after 2028. Who the players are and where margin and exposure sit.What South African fuel boards must have on the register before 2027The ten strategic risks for South African fuel businesses going into 2027: what each one is, why it is on the register now, the early warnings and who should own it.Days of cover, licences, gas: the controls that move the ratingFor each of the ten oil and gas risks in South Africa: the control that moves the rating, the gap most commonly observed and the evidence a board should ask for.What a risk assessment should tell your boardIt should show your biggest exposures, how well they are controlled and what to fix first.ISO 31000 or COSO ERM?ISO 31000 sets out principles and a process. COSO ERM ties risk to strategy and performance. Many organisations draw on both.Writing a risk appetite statement people can useA risk appetite statement only works if it sets limits people can act on.

Common questions

Before you book

What is the key point?

A risk register goes stale when nobody owns the actions in it.

The register becomes a compliance task: what does this mean?

Owners are named but actions are not: what does this mean?

Link the register to decisions: what does this mean?

Bring the register into budget, project and strategy discussions. When leaders use it to make decisions, out-of-date entries get noticed and corrected.

Start with a free assessment

Book with our team. A review of where your risk management stands today and a recommended next step.

Request a Free Assessment