Risk Registers Age Like Milk

Ask to see any company’s risk register and you can usually tell when it was written. You can tell from the contents, not the date in the corner. It describes systems that have since been replaced, vendors that have since been dropped, and a headcount from two reorganizations ago. The risks that actually hurt the business in the meantime (the engineer who left with the only working knowledge of a critical system, the SaaS tool the marketing team adopted without a review, the acquisition that doubled the attack surface overnight) never made the list.

Risk registers age like milk. Fresh, they are genuinely useful: a shared, honest picture of what can hurt the business and what you are doing about it. Left sitting, they turn. And because a stale register still looks like a register, it gives leadership the comfort of having one without the substance.

The decay starts on day one. A register is a snapshot taken on the day it was written, and the business is not a snapshot. People join and leave, taking access rights and institutional knowledge with them. Vendors get added faster than procurement can track. New systems go live. Each of those changes moves real risk, and none of them waits for the annual review.

There is a second, quieter failure: registers describe categories while incidents happen through mechanisms. “Ransomware” appears on nearly every register I read. The useful question is how ransomware would actually get in. In our firm’s analysis of 2024 breach disclosures, stolen credentials were the leading attack vector in cyberattacks against publicly traded companies, and nearly three-quarters of breached organizations could not or would not name the vector at all. A register that says “ransomware: high” and stops there has not identified a risk. It has named a headline.

The annual review is its own problem. In most organizations it exists to satisfy an auditor, and it shows. The same entries carry forward year after year, scores unchanged, owners long gone. The register gets updated in the weeks before the audit and ignored in the other fifty. That is audit furniture: it looks right, it passes inspection, and it supports nothing.

A living register looks different, and it is smaller than you think.

Ten to fifteen entries that matter beat sixty that nobody reads. Every entry needs a named owner, a person who will answer for it rather than a department. Scores should move. If nothing on the register has changed in a year, the register is wrong, because the business certainly changed. Entries also die. When a risk has sat at “medium” for three years with no treatment and no incident, accept it explicitly or delete it. A register that never shrinks is a graveyard, not a tool.

Reviews run on two clocks. One is a fixed cadence: quarterly works for most lean teams, sixty minutes, standing agenda. The other is event-driven, and it matters more. Define the triggers in advance: a key person resigns, a new vendor touches customer data, a system goes live, an incident or near miss, the company enters a new market. Each trigger earns a thirty-minute look at the affected entries, not a rewrite of the whole document.

The register also has to earn its place in decisions. When leadership debates a new product line, an acquisition, or an office closure, it belongs in the room. The moment it informs a real decision, people keep it current, because being wrong starts to cost them something.

None of this requires a GRC platform or a dedicated risk team. A spreadsheet, a named owner per entry, one hour a quarter, and thirty minutes after each trigger event is enough for most mid-sized organizations. The reporting to leadership can fit on three slides: what is new, what moved, what was retired. The discipline matters more than the tooling.

If you want to know whether your register is alive, run the milk test. Open it, pick any three entries, and ask when each one last changed a decision. If the honest answer is “it hasn’t,” you do not have a risk register. You have a compliance artifact with a date in the corner, quietly going sour.