An IT risk register is a document that records and tracks the significant IT risks that an organization faces across its various functions, processes, and activities. An IT risk register can help to provide a comprehensive and consistent view of the organization’s IT risk profile, and to support the decision making and reporting of the IT risk management function1.
One of the data that must be updated to maintain an IT risk register is the expected frequency and potential impact of each IT risk. The expected frequency is the probability or likelihood of the IT risk occurring, based on historical data, statistical analysis, expert judgment, or other methods. The potential impact is the magnitude or severity of the consequences or outcomes of the IT risk, measured in terms of cost, time, quality, reputation, or other criteria2.
Updating the expected frequency and potential impact of each IT risk is essential for maintaining an IT risk register, because it can help to:
Evaluate and prioritize the IT risks based on their risk level, which is calculated by multiplying the frequency and impact
Monitor and track the changes or trends in the IT risk exposure and performance over time
Identify and implement the appropriate risk response strategies and controls, based on the risk level and the risk appetite and tolerance of the organization
Report and communicate the IT risk status and progress to the stakeholders, using risk indicators, dashboards, or matrices3
The other options are not the data that must be updated to maintain an IT risk register, but rather the data that are used as inputs or outputs of the IT risk management process. Risk tolerance is the acceptable variation in the outcomes related to specific objectives or risks. Risk tolerance is used to measure the IT risk analysis and to guide the IT risk response. Enterprise-wide IT risk assessment is a process that identifies, analyzes, and evaluates the IT risks across theorganization. Enterprise-wide IT risk assessment is used topopulate the IT risk register and to inform the IT risk response. Risk appetite is the amount and type of risk that an organization is willing to accept in order to achieve its objectives. Risk appetite is used to guide the IT risk analysis and to align the IT risk response. References =
Risk Register - ISACA
Risk Analysis - ISACA
Risk Register 2021-2022 - UNECE
[How To Conduct Business Impact Analysis in 8 Easy Steps - G2]
[Risk Appetite and Risk Tolerance - ISACA]
[Enterprise Risk Assessment - ISACA]
[CRISC Review Manual, 7th Edition]
