Risk Register
Identifies populated risk registers, risk matrices and enterprise risk reports: risk IDs, rated likelihood/consequence/residual values and named risk owners. Titles alone are discovery-only.
- Type
- regex
- Confidence
- medium
- Confidence justification
- Medium confidence: titles are discovery-only; enforcement requires risk IDs, rated values or named owners, and 85 adds a second structure and treatment context.
- Jurisdictions
- global
- Regulations
- Financial Accountability Act 2009 (Qld)
- Frameworks
- DISP, ISO 27001, NIST CSF
- Data categories
- governance, security
- Scope
- narrow
- Risk rating
- 8
Should match
Corporate risk register - Q3 2026 Risk ID: CR-014 Title: Loss of key payroll vendor Likelihood: Possible Consequence: Major Residual rating: High Risk owner: Dana Whitfield (CFO) Existing controls: vendor exit clause; treatment plan approved by the audit and risk committee.— High tier (85) - risk ID, ratings and named owner with treatment contextRisk register extract: Risk ID: ICT-022 - unsupported database version on the permit system.— Medium tier (75) - risk ID onlyProject risk matrix row - Likelihood: Likely, flooding of the site compound during the wet season.— Medium tier (75) - rated likelihood onlyThe risk register will be discussed at the next committee meeting.— Discovery tier (65) - title only
Should not match
This guidance explains how agencies should rate likelihood and consequence in a risk matrix, from rare to almost certain.— Guidance textRisk register template Risk ID: ____ Likelihood: ____ Consequence: ____ Risk owner: ____— Blank templateNews report: the auditor found the department's risk register had not been updated for two years.— News framingTraining course slide: a risk matrix with Likelihood: Likely and Consequence: Major gives a High rating.— Training framing with ratings must not enforce
Known false positives
- Risk management guidance, risk matrix explainers and news about risk registers. Mitigation: Titles are discovery-only; enforcement needs populated risk IDs, ratings or named owners, and guidance/training/news/template framing is excluded.