{"id":70892,"date":"2026-10-09T10:52:25","date_gmt":"2026-10-09T08:52:25","guid":{"rendered":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/"},"modified":"2026-10-19T11:51:57","modified_gmt":"2026-10-19T09:51:57","slug":"risk-register-grows-nobody-looks","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/","title":{"rendered":"When the Risk Register Grows, but Nobody Looks Anymore"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">A risk register is meant to show which risks an organisation is aware of and how it deals with them. In many organisations the list grows year after year, while its connection to actual decisions fades. Entries are added and given new dates, but rarely reviewed in substance, and updates follow the calendar of the next audit rather than the actual risk situation. A closer look quickly reveals whether a register still steers anything or merely documents.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>A risk register loses its steering function when entries are updated continuously but no longer trigger a recognisable decision about resources, priority or measures. This becomes visible when mainly data fields and status change, while nobody can explain which decision a risk marked red is supposed to trigger. FINMA requirements explicitly demand more than formal completeness.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-how-can-you-tell-that-a-risk-register-me\">How can you tell that a risk register merely documents?<\/a><\/li>\n<li><a href=\"#a2-what-does-regulation-actually-require-of\">What does regulation actually require of a risk register?<\/a><\/li>\n<li><a href=\"#a3-why-does-a-registers-completeness-say-no\">Why does a register&#8217;s completeness say nothing about its steering effect?<\/a><\/li>\n<li><a href=\"#a4-how-does-the-gap-between-register-and-de\">How does the gap between register and decision show up in daily practice?<\/a><\/li>\n<li><a href=\"#a5-what-is-a-concrete-first-step-to-check\">What is a concrete first step to check?<\/a><\/li>\n<\/ol>\n<\/nav>\n<h2 id=\"a1-how-can-you-tell-that-a-risk-register-me\">How can you tell that a risk register merely documents?<\/h2>\n<p>A clear signal is that, for a given entry, only the date changes on a regular basis, while nobody can any longer say which decision the assessment is supposed to influence.<\/p>\n<p>A specialist article by Blindspot Solutions describes exactly this pattern: a recently updated risk looks well managed, even if only the review date was changed. A cell marked red creates an impression of seriousness, even when nobody can explain which decision it is supposed to trigger. The register thereby fulfils a formal function without any substantive review having taken place.<\/p>\n<p>The entry on risk registers in the online reference work Wikipedia calls this phenomenon ritualistic decision making: the illusion of control arises because a document exists, not because a risk is actually under control. Added to this is the confusion of map and territory, in which the register itself becomes the object of attention while the real risk drops out of view.<\/p>\n<h2 id=\"a2-what-does-regulation-actually-require-of\">What does regulation actually require of a risk register?<\/h2>\n<p>FINMA Circular 2023\/1 requires banks to maintain an institution-wide, consistently categorised inventory of operational risks, the effectiveness of which executive management must review regularly.<\/p>\n<p>The <a href=\"https:\/\/www.finma.ch\/en\/~\/media\/finma\/dokumente\/dokumentencenter\/myfinma\/rundschreiben\/finma-rs-2023-01-20221207.pdf?sc_lang=en\" target=\"_blank\" rel=\"noopener\">FINMA Circular 2023\/1, Operational risks and resilience \u2013 banks<\/a>, was issued on 7 December 2022 and entered into force on 1 January 2024. It replaced the former Circular 2008\/21 of 20 November 2008. Among other requirements, it addresses operational resilience, including the identification of critical functions and their disruption tolerances, as well as an inventory of ICT assets. These elements should connect to risk information: the register should help teams understand which risks threaten critical functions, what level of disruption is tolerable, and which ICT assets or dependencies need attention.<\/p>\n<p>The Basel Committee on Banking Supervision stated in a summary dated 27 April 2023 that Principle 6 of the <a href=\"https:\/\/www.bis.org\/fsi\/fsisummaries\/psmor.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Principles for the Sound Management of Operational Risk<\/a> obliges senior management to comprehensively identify and assess risks in all material products, processes and systems. Circular 2023\/1 explicitly requires executive management to ensure the effectiveness of design and implementation through regular reviews. A register that merely simulates this review satisfies the form of the requirement, not its purpose.<\/p>\n<figure class=\"rc-shot\"><img decoding=\"async\" src=\"https:\/\/swissgrc.com\/wp-content\/uploads\/2026\/10\/Bildvorschau.png\" alt=\"Risiko- und Kontrollbeurteilung mit Risikomatrix in der SwissGRC Plattform\" \/><figcaption>Risiko- und Kontrollbeurteilung mit Risikomatrix in der SwissGRC Plattform<\/figcaption><\/figure>\n<h2 id=\"a3-why-does-a-registers-completeness-say-no\">Why does a register&#8217;s completeness say nothing about its steering effect?<\/h2>\n<p>Because a register can appear complete even when none of its entries influences a resource allocation, a plan, or any other concrete decision.<\/p>\n<p>The specialist article by Blindspot Solutions refers to the position of the Australian National Audit Office, according to which decision makers need the right quality and quantity of risk information, and risk should feed into policy proposals, business cases, resource allocation and planning. This standard goes beyond merely maintaining a register: an entry that never feeds into one of these decisions has failed its purpose, even if it is formally kept in correct order.<\/p>\n<p>A specialist article by Risk Companion describes the end state of this development as compliance theatre: risk documentation is produced to satisfy a standard, while actual risk management quietly grinds to a halt between workshop and board meeting. The register exists, the steering does not.<\/p>\n<h2 id=\"a4-how-does-the-gap-between-register-and-de\">How does the gap between register and decision show up in daily practice?<\/h2>\n<p>It shows up in the fact that a register mainly moves around the time of audits and otherwise remains unchanged for months.<\/p>\n<p>A specialist article by CyberSierra observes that risk registers are often created during an annual compliance exercise or at the start of a project and then rarely updated afterwards, which means they age quickly and no longer reflect the current risk situation. A specialist article by V-Comply adds that in many companies a register remains untouched for months and is only hastily caught up during an internal audit. When actual incidents occur, it often becomes apparent that the register had not anticipated the risk that materialised.<\/p>\n<p>The FINMA Risk Monitor 2025, published on 17 November 2025, identifies nine principal risks rated high. Five are non-financial: money laundering, sanctions, outsourcing, cyberattacks, and ICT risks arising from system complexity, software errors and outdated systems. FINMA also highlights growing dependence on a small number of central service providers, particularly in ICT infrastructure and cloud services, and calls for stronger technological resilience. A register that does not reflect these developments may no longer represent the actual risk situation, even if it remains formally complete. <a href=\"https:\/\/www.finma.ch\/en\/news\/2025\/11\/20251117-mm-risikomonitor\/\" target=\"_blank\" rel=\"noopener\">FINMA Risk Monitor 2025<\/a><\/p>\n<h2 id=\"a5-what-is-a-concrete-first-step-to-check\">What is a concrete first step to check?<\/h2>\n<p>The first step is to review the most recently edited entries in a risk register and determine whether the assessment has changed or only the date. The following five steps provide a practical starting point.<\/p>\n<h3>Step 1: Identify the owner and decision<\/h3>\n<p>For every red or high-rated risk, identify the responsible person and define which decision, escalation or measure the risk should trigger.<\/p>\n<h3>Step 2: Compare the dates<\/h3>\n<p>Record the date of the last decision alongside the date of the last review. If the review date has changed but no decision has been made, the entry may only have been maintained formally.<\/p>\n<h3>Step 3: Check incidents and losses<\/h3>\n<p>Verify whether incidents and losses from the previous year are reflected in the risk register. If they are missing, clarify why they are not considered relevant.<\/p>\n<h3>Step 4: Review residual risk ratings<\/h3>\n<p>Check whether residual risk ratings change after measures have been completed. Any adjustment should be supported by evidence showing how the measures have affected the remaining risk.<\/p>\n<h3>Step 5: Connect risks to operational resilience<\/h3>\n<p>For relevant critical functions, verify that the associated risks are linked to disruption tolerances, ICT assets and third-party services on which those functions depend.<\/p>\n<p>If any of these steps reveal gaps, the relevant entries should be reviewed substantively rather than simply assigned a new review date. This check can be carried out during the next regular risk management meeting without introducing a new procedure.<\/p>\n<p>The shift from pure evidence-keeping to a steering instrument cannot be decided once and for all. It can only be achieved through repeated checks of this kind. Wherever this connection between entry and decision is missing, a second look is worthwhile before a new risk is recorded.<\/p>\n<div class=\"rc-bridge\">\n<div class=\"rc-bridge-mark\"><\/div>\n<div>\n<div class=\"rc-bridge-label\">Related<\/div>\n<h3>Linking risk entries to decisions<\/h3>\n<p>The Risk Management solution connects assessments with measures and responsibilities. It shows whether an entry has changed since the last decision.<\/p>\n<p><a href=\"https:\/\/swissgrc.com\/en\/risk-management-software\/\">Risk Management<\/a><\/p>\n<\/div>\n<\/div>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>Check the most recently edited entries to see whether the assessment changed or only the date.<\/li>\n<li>For every entry rated red or high, require a nameable decision about resources or measures.<\/li>\n<li>Treat the regular review by executive management under FINMA Circular 2023\/1 as a substantive obligation, not merely a formal one.<\/li>\n<li>Reconcile the register with current supervisory priorities, including cyberattacks, ICT risks and outsourcing dependencies.<\/li>\n<li>Check that relevant risks connect to critical functions, disruption tolerances and the ICT asset inventory.<\/li>\n<li>Verify that incidents and losses are reflected in the register and that residual ratings are reassessed after measures are completed.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What is ritualistic decision making in risk registers?<\/span><\/summary>\n<div class=\"rc-faq-answer\">The Wikipedia entry on risk registers describes ritualistic decision making as a phenomenon in which a document simulates control without a risk actually being managed. Added to this is the confusion of map and territory, in which the register itself becomes the object of attention while the real risk drops out of view.<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Since when has FINMA Circular 2023\/1 been in force?<\/span><\/summary>\n<div class=\"rc-faq-answer\">FINMA Circular 2023\/1 was issued on 7 December 2022 and entered into force on 1 January 2024. It replaced the former Circular 2008\/21 of 20 November 2008 and is based on the Banking Ordinance and the Financial Institutions Ordinance.<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What does compliance theatre mean in risk management?<\/span><\/summary>\n<div class=\"rc-faq-answer\">A specialist article by Risk Companion describes compliance theatre as a state in which risk documentation is produced to formally satisfy a standard, while actual risk management grinds to a halt between workshop and board meeting. The register exists, but the actual steering no longer takes place.<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Which risks does the FINMA Risk Monitor 2025 focus on?<\/span><\/summary>\n<div class=\"rc-faq-answer\">The FINMA Risk Monitor 2025 identifies nine principal risks rated high. Its five non-financial risks are money laundering, sanctions, outsourcing, cyberattacks, and ICT risks linked to system complexity, software errors and outdated systems. FINMA also highlights dependence on a small number of central service providers and the need to strengthen technological resilience. <a href=\"https:\/\/www.finma.ch\/en\/news\/2025\/11\/20251117-mm-risikomonitor\/\" target=\"_blank\" rel=\"noopener\">Read the official FINMA Risk Monitor 2025.<\/a><\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">How often should a risk register be updated?<\/span><\/summary>\n<div class=\"rc-faq-answer\">A risk register should be updated according to the actual risk situation, not the calendar of the next audit. What matters is not the frequency of change but whether every update influences a recognisable decision about resources, priority or measures.<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/www.finma.ch\/en\/~\/media\/finma\/dokumente\/dokumentencenter\/myfinma\/rundschreiben\/finma-rs-2023-01-20221207.pdf?sc_lang=en\" target=\"_blank\" rel=\"noopener\">FINMA Circular 2023\/1, Operational risks and resilience \u2013 banks<\/a><span class=\"rc-source-pub\">FINMA<\/span><\/li>\n<li><a href=\"https:\/\/www.finma.ch\/en\/news\/2025\/11\/20251117-mm-risikomonitor\/\" target=\"_blank\" rel=\"noopener\">FINMA Risk Monitor 2025<\/a><span class=\"rc-source-pub\">FINMA<\/span><\/li>\n<li><a href=\"https:\/\/www.bis.org\/fsi\/fsisummaries\/psmor.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Principles for the Sound Management of Operational Risk, Executive Summary<\/a><span class=\"rc-source-pub\">Bank for International Settlements<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A risk register loses its steering function when entries are updated continuously but no longer trigger a recognisable decision about resources, priority or measures. This becomes visible when mainly data fields and status change, while nobody can explain which decision a risk marked red is supposed to trigger. FINMA requirements explicitly demand more than formal completeness.<\/p>\n","protected":false},"author":5,"featured_media":70893,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Rajeev Dutt","real_author_title":"Managing Director MEA & APAC","real_author_bio":"Builds the presence of Swiss GRC in Dubai and across the markets of the Middle East, Africa and Asia, seeing first-hand how differently local regulators interpret governance and compliance. This cross-jurisdictional perspective shapes his view of international markets.","real_author_photo":54679,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[166,228,229,230,231],"class_list":["post-70892","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-finma-circular-2023-1","tag-operational-risks","tag-risk-steering","tag-compliance-theatre","tag-finma-risk-monitor"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"A growing risk register loses its steering function when entries no longer trigger decisions about resources or measures.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Risk Register: When Documentation Replaces Steering\" \/>\n\t\t<meta property=\"og:description\" content=\"A growing risk register loses its steering function when entries no longer trigger decisions about resources or measures.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/risk-register-grows-nobody-looks-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/risk-register-grows-nobody-looks-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-09T08:52:25+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-19T09:51:57+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Risk Register: When Documentation Replaces Steering\" \/>\n\t\t<meta name=\"twitter:description\" content=\"A growing risk register loses its steering function when entries no longer trigger decisions about resources or measures.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/risk-register-grows-nobody-looks-swissgrc.webp\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#blogposting\",\"name\":\"Risk Register: When Documentation Replaces Steering\",\"headline\":\"When the Risk Register Grows, but Nobody Looks Anymore\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/10\\\/risk-register-grows-nobody-looks-swissgrc.webp\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract control grid graphic in navy, category When the Risk Register Grows,\"},\"datePublished\":\"2026-10-09T10:52:25+02:00\",\"dateModified\":\"2026-10-19T11:51:57+02:00\",\"inLanguage\":\"en-GB\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, FINMA Circular 2023\\\/1, operational risks, risk steering, compliance theatre, FINMA Risk Monitor\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#listItem\",\"name\":\"When the Risk Register Grows, but Nobody Looks Anymore\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#listItem\",\"position\":3,\"name\":\"When the Risk Register Grows, but Nobody Looks Anymore\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#authorImage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/01\\\/logo-red.svg\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/\",\"name\":\"Risk Register: When Documentation Replaces Steering\",\"description\":\"A growing risk register loses its steering function when entries no longer trigger decisions about resources or measures.\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/10\\\/risk-register-grows-nobody-looks-swissgrc.webp\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract control grid graphic in navy, category When the Risk Register Grows,\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-register-grows-nobody-looks\\\/#mainImage\"},\"datePublished\":\"2026-10-09T10:52:25+02:00\",\"dateModified\":\"2026-10-19T11:51:57+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Risk Register: When Documentation Replaces Steering<\/title>\n\n","aioseo_head_json":{"title":"Risk Register: When Documentation Replaces Steering","description":"A growing risk register loses its steering function when entries no longer trigger decisions about resources or measures.","canonical_url":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#blogposting","name":"Risk Register: When Documentation Replaces Steering","headline":"When the Risk Register Grows, but Nobody Looks Anymore","author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/risk-register-grows-nobody-looks-swissgrc.webp","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract control grid graphic in navy, category When the Risk Register Grows,"},"datePublished":"2026-10-09T10:52:25+02:00","dateModified":"2026-10-19T11:51:57+02:00","inLanguage":"en-GB","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#webpage"},"articleSection":"Regulation &amp; Supervision, FINMA Circular 2023\/1, operational risks, risk steering, compliance theatre, FINMA Risk Monitor"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#listItem","name":"When the Risk Register Grows, but Nobody Looks Anymore"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#listItem","position":3,"name":"When the Risk Register Grows, but Nobody Looks Anymore","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/en\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/en\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/en\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#authorImage","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/01\/logo-red.svg","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#webpage","url":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/","name":"Risk Register: When Documentation Replaces Steering","description":"A growing risk register loses its steering function when entries no longer trigger decisions about resources or measures.","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/risk-register-grows-nobody-looks-swissgrc.webp","@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#mainImage","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract control grid graphic in navy, category When the Risk Register Grows,"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/#mainImage"},"datePublished":"2026-10-09T10:52:25+02:00","dateModified":"2026-10-19T11:51:57+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/en\/#website","url":"https:\/\/swissgrc.com\/en\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"en-GB","publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"}}]},"og:locale":"en_GB","og:site_name":"Swiss GRC | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"Risk Register: When Documentation Replaces Steering","og:description":"A growing risk register loses its steering function when entries no longer trigger decisions about resources or measures.","og:url":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/","og:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/risk-register-grows-nobody-looks-swissgrc.webp","og:image:secure_url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/risk-register-grows-nobody-looks-swissgrc.webp","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-10-09T08:52:25+00:00","article:modified_time":"2026-10-19T09:51:57+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"Risk Register: When Documentation Replaces Steering","twitter:description":"A growing risk register loses its steering function when entries no longer trigger decisions about resources or measures.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/risk-register-grows-nobody-looks-swissgrc.webp","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"8 minutes"},"aioseo_meta_data":{"post_id":"70892","title":"Risk Register: When Documentation Replaces Steering","description":"A growing risk register loses its steering function when entries no longer trigger decisions about resources or measures.","keywords":null,"keyphrases":{"focus":{"keyphrase":"risk register","score":0,"analysis":[]},"additional":[{"keyphrase":"FINMA Circular 2023\/1","score":0,"analysis":[]},{"keyphrase":"operational risks","score":0,"analysis":[]},{"keyphrase":"risk steering","score":0,"analysis":[]},{"keyphrase":"compliance theatre","score":0,"analysis":[]},{"keyphrase":"FINMA Risk Monitor","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"Risk Register: When Documentation Replaces Steering","og_description":"A growing risk register loses its steering function when entries no longer trigger decisions about resources or measures.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"Risk Register: When Documentation Replaces Steering","twitter_description":"A growing risk register loses its steering function when entries no longer trigger decisions about resources or measures.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-10-19 09:52:46","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-10-09 10:52:25","updated":"2026-10-19 10:28:10","focus_keyword":"risk register","additional_keywords":[{"word":"FINMA Circular 2023\/1","score":83,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"operational risks","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"risk steering","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"compliance theatre","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"FINMA Risk Monitor","score":83,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tWhen the Risk Register Grows, but Nobody Looks Anymore\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/en\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/"},{"label":"When the Risk Register Grows, but Nobody Looks Anymore","link":"https:\/\/swissgrc.com\/en\/risk-register-grows-nobody-looks\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/comments?post=70892"}],"version-history":[{"count":3,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70892\/revisions"}],"predecessor-version":[{"id":70922,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70892\/revisions\/70922"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media\/70893"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media?parent=70892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/categories?post=70892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/tags?post=70892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}