IT Risk Register
Organisation: _______________________
Owner: IT Security / Compliance
Review date: _______________________
Risk scoring
Risk score = Likelihood (1–5) × Impact (1–5)
| Score | Rating |
|---|
| 1–4 | Low |
| 5–9 | Medium |
| 10–15 | High |
| 16–25 | Critical |
Risk register
| Risk ID | Description | Category | Likelihood | Impact | Score | Owner | Mitigation | Target date | Status |
|---|
| R-001 | Orphaned SaaS accounts after offboarding | Access | 4 | 4 | 16 | IT Ops | Automated leaver workflow | Q2 2026 | Open |
| R-002 | Unpatched endpoint vulnerabilities | Security | 3 | 5 | 15 | IT Ops | Agent-based patching policy | Q1 2026 | In progress |
| R-003 | Incomplete asset inventory for audit | ITAM | 3 | 3 | 9 | ITAM | Quarterly reconciliation | Q2 2026 | Open |
| R-004 | | | | | | | | | |
Review log