Risk Registers: The Document That Goes Stale Fastest

Open your risk register. If it still lists a supplier you stopped using two years ago, and says nothing about the system your whole team now depends on, you do not have a risk register. You have a document that once was one.

Why they rot

The register gets written properly. Somebody sits down, thinks hard, interviews people, and produces something genuinely useful. Then it goes into a folder and the business keeps changing around it.

Nothing dramatic causes the decay. A supplier is swapped. A process moves into a new tool. The person who owned three risks leaves the company. A workaround becomes the main way something gets done. Each change is small and none of them triggers a register update, because updating the register is nobody's specific job on any specific day.

A stale register is worse than an absent one, and this is the part that gets missed. An empty shelf tells you honestly that you have not done the work. A confident, out-of-date document tells you that you have, which is how a business ends up surprised by something that was foreseeable in April.

The columns that actually matter

Most templates give you eight or nine columns and the attention goes to the scoring ones, because they produce a number. The ones that determine whether the register is alive get the least care.

Column	Usual state	What it needs to be
The risk itself	A category, such as supply chain	A sentence naming what happens
Owner	A department, or somebody who left	One named person who knows they own it
Mitigation	Monitor the situation	A thing that was done, with a date
Last reviewed	Missing, or the day it was created	The field that drives the whole process
Score	Carefully calculated, rarely revisited	A rough ranking, honestly argued

Monitor the situation is the phrase to hunt for. It appears in the mitigation column of almost every register and it means nothing has been done. Replacing it with a dated action, or an honest accepted with no mitigation, is the single biggest improvement available to most registers.

What AI can carry

The work that causes registers to go stale is clerical, which makes it a reasonable fit. Four things in particular.

Drafting entries from what you already write. Your incident reports, near misses and complaint records are a description of your real risks, written by the people who hit them. Most businesses never connect the two documents, and the register ends up reflecting what somebody imagined in a meeting rather than what has actually gone wrong, which is the same gap described in getting value out of incident reports.

Flagging drift. An entry naming a supplier, a system or a person can be checked against your current supplier list, your current tool inventory and your current payroll. Anything referring to something that no longer exists goes on a short list for a human to look at.

Rewriting vagueness into specifics. Cyber risk becomes a sentence about what happens to your operations if a named system is unavailable for three days. The rewrite is a drafting job and the specificity is what makes a risk arguable.

And the review nag, which sounds trivial and is the one that keeps the document alive. Anything untouched for six months surfaces, with its owner, as a short list rather than a project.

The two jobs to withhold

Scoring is the first. A likelihood and impact rating looks like an analytical output and is actually a statement about your business: what it can absorb, what your contracts oblige you to, what your insurance covers, how much cash you have. A model will produce plausible numbers for all of it, and those numbers will carry the weight of having been calculated. Let it draft the entry and leave the rating to the people who carry the consequence.

Risk appetite is the second, and it is the more dangerous one. Deciding which risks you are content to accept is the whole point of having the document. Outsourcing that to anything, software included, means you have a register of somebody else's tolerances.

There is also the register entry people forget to write, which is the one about the AI tools themselves. If a system your team now relies on is not on the list, the list is incomplete in exactly the direction that matters, and your continuity plan probably has the same gap. The decision about when you would stop using one belongs in the register too, which is the argument in deciding your stopping conditions in advance.

A smaller register, reviewed more often

If you do one thing, cut it down. Eighty entries guarantees nobody reads to the bottom. Fifteen live risks with named owners and dated mitigations, plus an archive of closed ones, produces a document people reach for when deciding something.

Then move the review from annual to quarterly and make it short. Twenty minutes on what changed, what can be closed and what is new beats a half-day exercise once a year, and it is the cadence that keeps the rest of your governance documentation honest as well.

Frequently Asked Questions

What is a risk register?

A list of the things that could go wrong in your business, each with an owner, an assessment of how likely and how damaging it is, and what you are doing about it. The format is less important than the two columns most registers treat as decoration: who owns this risk, and when was this line last looked at.

Why do risk registers stop being useful?

Because they are written as a project and then maintained as an annual obligation. The business changes continuously and the document changes once a year, so within months it describes a company that no longer exists. A register listing a supplier you stopped using and omitting the system everyone now depends on is worse than no register, because it looks like diligence.

How many risks should be on it?

Few enough that someone reads the whole thing. A register with eighty entries is a filing exercise and nobody reviews it line by line. Fifteen to twenty live risks that genuinely keep you up at night, plus an archive of the ones you have closed out, gives you a document people actually use when making decisions.

Where does AI genuinely help?

With upkeep rather than judgment. Drafting new entries from incident reports and near misses you already write, flagging entries that have not been touched while the thing they describe has changed, checking that every risk still has a named owner who still works here, and rewriting vague entries into specific ones. The work that makes registers go stale is mostly clerical.

What should AI not do with a risk register?

Score the risks and set your risk appetite. A likelihood and impact rating is a statement about what your business can survive and what it is willing to accept, which depends on your cash position, your contracts, your insurance and your own tolerance. A model producing confident numbers for those gives you a register that looks rigorous and quietly encodes assumptions that are not yours.

How do you know if yours is working?

Ask whether anything in the last year was decided differently because of it. If a supplier was dual-sourced, a contract renegotiated, a backup actually tested or a project delayed because of a line in the register, it is doing its job. If the honest answer is that it gets updated before an audit and read at no other time, you have a compliance artifact rather than a management tool.