1. Introduction to the Technique
A Risk Register is a foundational risk management tool used by internal auditors to capture, track, and monitor risks across the organization. It serves as a live document that helps teams stay informed about current and emerging risks, their potential impact, and how they are being managed. For auditors like Auren, the risk register is not just a recordkeeping tool—it’s a roadmap that supports risk-based audit planning and facilitates transparency in risk ownership and mitigation.

2. Template for Applying the Risk Register
A practical risk register typically includes the following columns:

• Risk ID: A unique reference code

• Risk Description: Clear statement of the risk

• Root Cause: Why the risk exists

• Impact: What could happen if it materializes

• Likelihood & Impact Score: Quantitative or qualitative rating (e.g., High, Medium, Low)

• Risk Rating: Overall risk level based on scoring

• Controls/Mitigations: Existing controls in place

• Owner: Who is responsible for managing the risk

• Action Plan & Status: Any planned response and current status

3. Practical Example: ACME’s Digital Transformation Project
At ACME Corp, CEO Liora has launched a digital transformation project to automate customer service and logistics. Internal Auditor Auren joins the core planning team, led by Project Manager Aven, to establish a risk register for governance and tracking.

Together with department leads (IT, Legal, Operations), they identify and document critical project risks:

• Risk ID: DT-001
  Risk: Delay in software vendor delivery
  Root Cause: Dependency on third-party development timelines
  Impact: Project delays and budget overruns
  Likelihood/Impact: Likely / High
  Risk Rating: High
  Controls: Contractual penalties, weekly progress meetings
  Owner: Head of IT
  Action Plan & Status: Escalation procedure defined – In Progress

• Risk ID: DT-003
  Risk: Employee resistance to new tools
  Root Cause: Lack of training and communication
  Impact: Reduced adoption and operational inefficiencies
  Likelihood/Impact: Possible / Medium
  Risk Rating: Moderate
  Controls: Training plan, change champions network
  Owner: HR Manager
  Action Plan & Status: Training rollout scheduled – On Track

Auren uses this register not only to monitor risks but also to support a targeted audit later in the project lifecycle. It allows the team to stay aligned on priorities and helps Liora gain visibility over the project’s most critical risk areas.

By using a structured risk register, ACME ensures accountability, promotes informed decisions, and strengthens overall project governance—exactly what internal audit is there to support.