# When the Risk Register Grows, but Nobody Looks Anymore > Der Beitrag von Swiss GRC erklärt, woran man erkennt, dass ein Risikoregister nur dokumentiert und nichts mehr steuert. Er richtet sich an Risikoverantwortliche und nennt fünf Prüfschritte, die den Bezug zwischen Eintrag und Entscheidung wiederherstellen. - URL: https://swissgrc.com/en/risk-register-grows-nobody-looks/ - Publisher: SwissGRC® - Published: 2026-10-09 - Last updated: 2026-10-19 ## Key facts - Ein Risikoregister verliert seine Steuerungsfunktion, wenn Einträge laufend aktualisiert werden, aber keine erkennbare Entscheidung über Ressourcen, Priorität oder Massnahmen mehr auslösen. - Das FINMA-Rundschreiben 2023/1 wurde am 7. Dezember 2022 veröffentlicht, trat am 1. Januar 2024 in Kraft und ersetzte das Rundschreiben 2008/21 vom 20. November 2008. - Das FINMA-Rundschreiben 2023/1 verlangt von Banken ein institutsweites, einheitlich kategorisiertes Inventar der operationellen Risiken, dessen Wirksamkeit die Geschäftsleitung regelmässig überprüfen muss. - Der FINMA-Risikomonitor 2025 vom 17. November 2025 nennt neun Hauptrisiken mit hoher Einstufung, davon fünf nicht finanzielle: Geldwäscherei, Sanktionen, Outsourcing, Cyberangriffe und ICT-Risiken. - Als ersten Schritt empfiehlt der Beitrag, die zuletzt bearbeiteten Einträge zu prüfen und festzustellen, ob sich die Bewertung geändert hat oder nur das Datum. - Der Beitrag nennt fünf Prüfschritte: Verantwortliche und Entscheidung klären, Daten vergleichen, Vorfälle und Verluste prüfen, Restrisikobewertungen kontrollieren und Risiken mit der operationellen Resilienz verknüpfen. A risk register is meant to show which risks an organisation is aware of and how it deals with them. In many organisations the list grows year after year, while its connection to actual decisions fades. Entries are added and given new dates, but rarely reviewed in substance, and updates follow the calendar of the next audit rather than the actual risk situation. A closer look quickly reveals whether a register still steers anything or merely documents. In short A risk register loses its steering function when entries are updated continuously but no longer trigger a recognisable decision about resources, priority or measures. This becomes visible when mainly data fields and status change, while nobody can explain which decision a risk marked red is supposed to trigger. FINMA requirements explicitly demand more than formal completeness. ## How can you tell that a risk register merely documents? A clear signal is that, for a given entry, only the date changes on a regular basis, while nobody can any longer say which decision the assessment is supposed to influence. A specialist article by Blindspot Solutions describes exactly this pattern: a recently updated risk looks well managed, even if only the review date was changed. A cell marked red creates an impression of seriousness, even when nobody can explain which decision it is supposed to trigger. The register thereby fulfils a formal function without any substantive review having taken place. The entry on risk registers in the online reference work Wikipedia calls this phenomenon ritualistic decision making: the illusion of control arises because a document exists, not because a risk is actually under control. Added to this is the confusion of map and territory, in which the register itself becomes the object of attention while the real risk drops out of view. ## What does regulation actually require of a risk register? FINMA Circular 2023/1 requires banks to maintain an institution-wide, consistently categorised inventory of operational risks, the effectiveness of which executive management must review regularly. The [FINMA Circular 2023/1, Operational risks and resilience – banks](https://www.finma.ch/en/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2023-01-20221207.pdf?sc_lang=en), was issued on 7 December 2022 and entered into force on 1 January 2024. It replaced the former Circular 2008/21 of 20 November 2008. Among other requirements, it addresses operational resilience, including the identification of critical functions and their disruption tolerances, as well as an inventory of ICT assets. These elements should connect to risk information: the register should help teams understand which risks threaten critical functions, what level of disruption is tolerable, and which ICT assets or dependencies need attention. The Basel Committee on Banking Supervision stated in a summary dated 27 April 2023 that Principle 6 of the [Principles for the Sound Management of Operational Risk](https://www.bis.org/fsi/fsisummaries/psmor.pdf) obliges senior management to comprehensively identify and assess risks in all material products, processes and systems. Circular 2023/1 explicitly requires executive management to ensure the effectiveness of design and implementation through regular reviews. A register that merely simulates this review satisfies the form of the requirement, not its purpose. ![Risiko- und Kontrollbeurteilung mit Risikomatrix in der SwissGRC Plattform](https://swissgrc.com/wp-content/uploads/2026/10/Bildvorschau.png) Risiko- und Kontrollbeurteilung mit Risikomatrix in der SwissGRC Plattform ## Why does a register’s completeness say nothing about its steering effect? Because a register can appear complete even when none of its entries influences a resource allocation, a plan, or any other concrete decision. The specialist article by Blindspot Solutions refers to the position of the Australian National Audit Office, according to which decision makers need the right quality and quantity of risk information, and risk should feed into policy proposals, business cases, resource allocation and planning. This standard goes beyond merely maintaining a register: an entry that never feeds into one of these decisions has failed its purpose, even if it is formally kept in correct order. A specialist article by Risk Companion describes the end state of this development as compliance theatre: risk documentation is produced to satisfy a standard, while actual risk management quietly grinds to a halt between workshop and board meeting. The register exists, the steering does not. ## How does the gap between register and decision show up in daily practice? It shows up in the fact that a register mainly moves around the time of audits and otherwise remains unchanged for months. A specialist article by CyberSierra observes that risk registers are often created during an annual compliance exercise or at the start of a project and then rarely updated afterwards, which means they age quickly and no longer reflect the current risk situation. A specialist article by V-Comply adds that in many companies a register remains untouched for months and is only hastily caught up during an internal audit. When actual incidents occur, it often becomes apparent that the register had not anticipated the risk that materialised. The FINMA Risk Monitor 2025, published on 17 November 2025, identifies nine principal risks rated high. Five are non-financial: money laundering, sanctions, outsourcing, cyberattacks, and ICT risks arising from system complexity, software errors and outdated systems. FINMA also highlights growing dependence on a small number of central service providers, particularly in ICT infrastructure and cloud services, and calls for stronger technological resilience. A register that does not reflect these developments may no longer represent the actual risk situation, even if it remains formally complete. [FINMA Risk Monitor 2025](https://www.finma.ch/en/news/2025/11/20251117-mm-risikomonitor/) ## What is a concrete first step to check? The first step is to review the most recently edited entries in a risk register and determine whether the assessment has changed or only the date. The following five steps provide a practical starting point. ### Step 1: Identify the owner and decision For every red or high-rated risk, identify the responsible person and define which decision, escalation or measure the risk should trigger. ### Step 2: Compare the dates Record the date of the last decision alongside the date of the last review. If the review date has changed but no decision has been made, the entry may only have been maintained formally. ### Step 3: Check incidents and losses Verify whether incidents and losses from the previous year are reflected in the risk register. If they are missing, clarify why they are not considered relevant. ### Step 4: Review residual risk ratings Check whether residual risk ratings change after measures have been completed. Any adjustment should be supported by evidence showing how the measures have affected the remaining risk. ### Step 5: Connect risks to operational resilience For relevant critical functions, verify that the associated risks are linked to disruption tolerances, ICT assets and third-party services on which those functions depend. If any of these steps reveal gaps, the relevant entries should be reviewed substantively rather than simply assigned a new review date. This check can be carried out during the next regular risk management meeting without introducing a new procedure. The shift from pure evidence-keeping to a steering instrument cannot be decided once and for all. It can only be achieved through repeated checks of this kind. Wherever this connection between entry and decision is missing, a second look is worthwhile before a new risk is recorded. Related ### Linking risk entries to decisions The Risk Management solution connects assessments with measures and responsibilities. It shows whether an entry has changed since the last decision. [Risk Management](https://swissgrc.com/en/risk-management-software/) For practice ## Key points - Check the most recently edited entries to see whether the assessment changed or only the date. - For every entry rated red or high, require a nameable decision about resources or measures. - Treat the regular review by executive management under FINMA Circular 2023/1 as a substantive obligation, not merely a formal one. - Reconcile the register with current supervisory priorities, including cyberattacks, ICT risks and outsourcing dependencies. - Check that relevant risks connect to critical functions, disruption tolerances and the ICT asset inventory. - Verify that incidents and losses are reflected in the register and that residual ratings are reassessed after measures are completed. FAQ ## Frequently asked questions What is ritualistic decision making in risk registers? The Wikipedia entry on risk registers describes ritualistic decision making as a phenomenon in which a document simulates control without a risk actually being managed. Added to this is the confusion of map and territory, in which the register itself becomes the object of attention while the real risk drops out of view. Since when has FINMA Circular 2023/1 been in force? FINMA Circular 2023/1 was issued on 7 December 2022 and entered into force on 1 January 2024. It replaced the former Circular 2008/21 of 20 November 2008 and is based on the Banking Ordinance and the Financial Institutions Ordinance. What does compliance theatre mean in risk management? A specialist article by Risk Companion describes compliance theatre as a state in which risk documentation is produced to formally satisfy a standard, while actual risk management grinds to a halt between workshop and board meeting. The register exists, but the actual steering no longer takes place. Which risks does the FINMA Risk Monitor 2025 focus on? The FINMA Risk Monitor 2025 identifies nine principal risks rated high. Its five non-financial risks are money laundering, sanctions, outsourcing, cyberattacks, and ICT risks linked to system complexity, software errors and outdated systems. FINMA also highlights dependence on a small number of central service providers and the need to strengthen technological resilience. [Read the official FINMA Risk Monitor 2025.](https://www.finma.ch/en/news/2025/11/20251117-mm-risikomonitor/) How often should a risk register be updated? A risk register should be updated according to the actual risk situation, not the calendar of the next audit. What matters is not the frequency of change but whether every update influences a recognisable decision about resources, priority or measures. Sources 1. [FINMA Circular 2023/1, Operational risks and resilience – banks](https://www.finma.ch/en/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2023-01-20221207.pdf?sc_lang=en)FINMA 2. [FINMA Risk Monitor 2025](https://www.finma.ch/en/news/2025/11/20251117-mm-risikomonitor/)FINMA 3. [Principles for the Sound Management of Operational Risk, Executive Summary](https://www.bis.org/fsi/fsisummaries/psmor.pdf)Bank for International Settlements ## Frequently asked questions ### Woran erkenne ich, dass ein Risikoregister nur noch dokumentiert? Ein klares Signal ist, dass sich bei einem Eintrag regelmässig nur das Datum ändert. Niemand kann mehr sagen, welche Entscheidung die Bewertung beeinflussen soll, etwa bei einem rot markierten Risiko. ### Seit wann gilt das FINMA-Rundschreiben 2023/1? Das FINMA-Rundschreiben 2023/1 wurde am 7. Dezember 2022 veröffentlicht und trat am 1. Januar 2024 in Kraft. Es ersetzte das Rundschreiben 2008/21 vom 20. November 2008. ### Was bedeutet Compliance Theatre im Risikomanagement? Laut einem Fachartikel von Risk Companion bezeichnet der Begriff einen Zustand, in dem Risikodokumentation für eine Norm erstellt wird, während das eigentliche Risikomanagement zwischen Workshop und Verwaltungsratssitzung zum Stillstand kommt. Das Register existiert, die Steuerung nicht. ### Welche Risiken nennt der FINMA-Risikomonitor 2025? Der Risikomonitor 2025 identifiziert neun Hauptrisiken mit hoher Einstufung. Fünf davon sind nicht finanziell: Geldwäscherei, Sanktionen, Outsourcing, Cyberangriffe und ICT-Risiken aus Systemkomplexität, Softwarefehlern und veralteten Systemen. ### Wie prüfe ich als ersten Schritt, ob mein Risikoregister noch steuert? Prüfen Sie die zuletzt bearbeiteten Einträge und stellen Sie fest, ob sich die Bewertung geändert hat oder nur das Datum. Für jedes hoch oder rot bewertete Risiko sollten Verantwortliche und die auszulösende Entscheidung benannt sein.