Risk Register

Detects risk registers containing assessed vulnerabilities, likelihood ratings, and risk treatment plans.

Type

regex

Confidence

medium

Confidence justification

Medium confidence: keyword-based detection requires corroborative evidence for accurate identification.

Jurisdictions

global

Regulations

IPA 2009 (Qld), Privacy Act 1988 (Cth), SOCI Act 2018 (Cth)

Frameworks

DISP, ISO 27001, NIST CSF

Data categories

governance, security

Scope

narrow

Risk rating

8

Should match

• Enterprise risk register — Low-tier probe - register title without assessed values
• Risk register: inherent risk high, residual risk medium, likelihood likely. — Medium-tier probe - assessed values without treatment evidence
• Risk register: inherent risk high, residual risk medium; risk mitigation owner approved risk treatment and control effectiveness review. — High-tier probe - assessed values plus treatment evidence

Should not match

• Risk taking in sports — Sports-risk sibling
• At risk youth program — Social-programme prose
• The public governance page links to the enterprise risk register. — Public link mentions only the register title
• Template example: risk register with inherent risk high, residual risk medium, risk treatment, and control effectiveness. — Template contains otherwise high-tier evidence

Known false positives

• Generic risk in non-register contexts. Mitigation: Require register-specific terms like risk register, risk matrix, or risk owner.