RISK REGISTER
Legal name of the entity
Effective Date
Risk Owner Name or role accountable for risk (for example CISO)
Risks recorded 1 (0 high) Basis
ISO 31000 ISO/IEC 27001 cl.6 and 8 SOC 2 CC3 Risks are scored using the [methodology] method. Inherent risk is impact multiplied by likelihood; treatment reduces residual risk. This register is reviewed [cycle].
1. Methodology
Legal name of the entity assesses risk on a [methodology] scale. Each risk is scored for impact and likelihood; the product gives an inherent risk band (High at 15 or above, Medium 8 to 14, Low 1 to 7 on a 5 by 5 scale). Name or role accountable for risk (for example CISO) owns the register.
2. Register
The organisation records 1 risk(s):
Risk Impact Likelihood Band Treatment Owner __GAP[risks — — Not scored — —
3. Review and approval
This register is reviewed [cycle] and was approved by Name and designation on [date].
Approved by
Name and designation
______________________
Risk Owner
Name or role accountable for risk (for example CISO)
______________________