When the Risk Register Grows, but Nobody Looks Anymore

A risk register is meant to show which risks an organisation is aware of and how it deals with them. In many organisations the list grows year after year, while its connection to actual decisions fades. Entries are added and given new dates, but rarely reviewed in substance, and updates follow the calendar of the next audit rather than the actual risk situation. A closer look quickly reveals whether a register still steers anything or merely documents.

How can you tell that a risk register merely documents?

A clear signal is that, for a given entry, only the date changes on a regular basis, while nobody can any longer say which decision the assessment is supposed to influence.

A specialist article by Blindspot Solutions describes exactly this pattern: a recently updated risk looks well managed, even if only the review date was changed. A cell marked red creates an impression of seriousness, even when nobody can explain which decision it is supposed to trigger. The register thereby fulfils a formal function without any substantive review having taken place.

The entry on risk registers in the online reference work Wikipedia calls this phenomenon ritualistic decision making: the illusion of control arises because a document exists, not because a risk is actually under control. Added to this is the confusion of map and territory, in which the register itself becomes the object of attention while the real risk drops out of view.

What does regulation actually require of a risk register?

FINMA Circular 2023/1 requires banks to maintain an institution-wide, consistently categorised inventory of operational risks, the effectiveness of which executive management must review regularly.

The FINMA Circular 2023/1, Operational risks and resilience – banks, was issued on 7 December 2022 and entered into force on 1 January 2024. It replaced the former Circular 2008/21 of 20 November 2008. Among other requirements, it addresses operational resilience, including the identification of critical functions and their disruption tolerances, as well as an inventory of ICT assets. These elements should connect to risk information: the register should help teams understand which risks threaten critical functions, what level of disruption is tolerable, and which ICT assets or dependencies need attention.

The Basel Committee on Banking Supervision stated in a summary dated 27 April 2023 that Principle 6 of the Principles for the Sound Management of Operational Risk obliges senior management to comprehensively identify and assess risks in all material products, processes and systems. Circular 2023/1 explicitly requires executive management to ensure the effectiveness of design and implementation through regular reviews. A register that merely simulates this review satisfies the form of the requirement, not its purpose.

Why does a register’s completeness say nothing about its steering effect?

Because a register can appear complete even when none of its entries influences a resource allocation, a plan, or any other concrete decision.

The specialist article by Blindspot Solutions refers to the position of the Australian National Audit Office, according to which decision makers need the right quality and quantity of risk information, and risk should feed into policy proposals, business cases, resource allocation and planning. This standard goes beyond merely maintaining a register: an entry that never feeds into one of these decisions has failed its purpose, even if it is formally kept in correct order.

A specialist article by Risk Companion describes the end state of this development as compliance theatre: risk documentation is produced to satisfy a standard, while actual risk management quietly grinds to a halt between workshop and board meeting. The register exists, the steering does not.

How does the gap between register and decision show up in daily practice?

It shows up in the fact that a register mainly moves around the time of audits and otherwise remains unchanged for months.

A specialist article by CyberSierra observes that risk registers are often created during an annual compliance exercise or at the start of a project and then rarely updated afterwards, which means they age quickly and no longer reflect the current risk situation. A specialist article by V-Comply adds that in many companies a register remains untouched for months and is only hastily caught up during an internal audit. When actual incidents occur, it often becomes apparent that the register had not anticipated the risk that materialised.

The FINMA Risk Monitor 2025, published on 17 November 2025, identifies nine principal risks rated high. Five are non-financial: money laundering, sanctions, outsourcing, cyberattacks, and ICT risks arising from system complexity, software errors and outdated systems. FINMA also highlights growing dependence on a small number of central service providers, particularly in ICT infrastructure and cloud services, and calls for stronger technological resilience. A register that does not reflect these developments may no longer represent the actual risk situation, even if it remains formally complete. FINMA Risk Monitor 2025

What is a concrete first step to check?

The first step is to review the most recently edited entries in a risk register and determine whether the assessment has changed or only the date. The following five steps provide a practical starting point.

Step 1: Identify the owner and decision

For every red or high-rated risk, identify the responsible person and define which decision, escalation or measure the risk should trigger.

Step 2: Compare the dates

Record the date of the last decision alongside the date of the last review. If the review date has changed but no decision has been made, the entry may only have been maintained formally.

Step 3: Check incidents and losses

Verify whether incidents and losses from the previous year are reflected in the risk register. If they are missing, clarify why they are not considered relevant.

Step 4: Review residual risk ratings

Check whether residual risk ratings change after measures have been completed. Any adjustment should be supported by evidence showing how the measures have affected the remaining risk.

Step 5: Connect risks to operational resilience

For relevant critical functions, verify that the associated risks are linked to disruption tolerances, ICT assets and third-party services on which those functions depend.

If any of these steps reveal gaps, the relevant entries should be reviewed substantively rather than simply assigned a new review date. This check can be carried out during the next regular risk management meeting without introducing a new procedure.

The shift from pure evidence-keeping to a steering instrument cannot be decided once and for all. It can only be achieved through repeated checks of this kind. Wherever this connection between entry and decision is missing, a second look is worthwhile before a new risk is recorded.