An operational risk register is the single source of truth for how threats translate to your operations, who owns each risk, and what will trigger action. It aligns security, resilience, and the business on the same definitions so you can decide faster and cut duty-of-care exposure.

Formally, it is a structured record of risks tied to assets, processes, and people with agreed scoring, owners, controls, and review dates. Unlike financial-services ledgers, an operations-first register must localize by site and traveler population, reflect your risk appetite, and connect to continuous monitoring. If you are standing up your program, pair this page with Running an Operational Risk Assessment and the hub overview, Operational Risk Management Beyond the Banking Textbook. Teams across Financial Services, Pharmaceuticals & Life Sciences, and Professional Services use registers like this to cover distributed branches and traveling staff, regulated lab and manufacturing sites, and consultants working in dynamic environments.

A usable template captures the context you actually brief against. At minimum include a unique Risk ID and Title, a concise Risk Statement outlining cause, event, and impact, and the Risk Category aligned to how you operate. Many programs mirror security, political, and operational domains and, where relevant, add cyber or maritime sub-risks.

Tie each entry to Exposure. List affected Assets and Locations such as facilities, critical suppliers, and employee populations by country or city. Note Business Functions at risk, key Dependencies, and any Regulatory or Duty-of-Care obligations.

Score consistently with Likelihood and Impact definitions, record Inherent Risk before controls, list existing Controls and Protective Measures, and specify Control Effectiveness. Capture Early Warning Indicators and Tripwires you will monitor, the Risk Owner and Control Owner, the Risk Appetite/Tolerance for this scenario, the Planned Response with decision thresholds, Residual Risk after controls, and the next Review Date. See concrete scenarios to seed entries in Operational Risk Examples: What Actually Disrupts Operations.

Pick a scale and make it explicit. Most teams use a 1–5 scale for Likelihood and Impact with written criteria for each point, then derive Inherent Risk as the pre-control score. Calibrate Impact with your own criticality ratings for sites, suppliers, and traveler groups so the same event scores differently for a sole-source plant versus a satellite office.

Use real evidence to anchor Likelihood. Country and city risk ratings, human-verified incident histories, and forward-looking analysis inform baseline likelihood by location. Continuous feeds like Seerist’s Verified Events and analyst assessments help revise scores as conditions shift, while AskAnna can summarize what to watch next from recent analysis. After listing controls and their effectiveness, derive Residual Risk and note whether it sits within your stated appetite. If it does not, record additional treatments, owners, and deadlines. Keep your matrix simple enough to brief in two minutes and precise enough to survive scrutiny.

Every entry needs one accountable Risk Owner who can allocate budget, a Control Owner for day-to-day mitigations, and a named Reviewer/Approver. Define who updates indicators, who escalates on triggers, and who closes actions. For distributed programs, align to your governance model so operational sites propose changes and central risk validates.

Set a cadence that matches exposure and change. Critical risks tied to business-stopping assets merit monthly checks, high risks quarterly, medium semiannual, and low at least annually, with ad hoc reviews on tripwires like election calendars, regulatory moves, or sustained protest activity. As automation improves, many teams route alerts and analysis into workspaces or LLM copilots to draft daily priorities, but precise recommendations still rely on your register’s encoded appetite and thresholds. Map both facilities and employee populations where appropriate so duty-of-care risks are not missed. Pair this with continuous monitoring to move from point-in-time to living governance; see Operational Risk Monitoring: From Point-in-Time to Continuous.

Risk ID OR-017. Title Civil unrest disrupts access to distribution center. Statement If sustained protests occur within 5 km of the site during peak hours, then staff and carriers may be unable to enter, delaying outbound shipments and increasing safety exposure. Category Security: civil unrest; Operational: infrastructure access.

Exposure Distribution center A, alternate site B as fallback; 240 on-site staff; two time-critical outbound routes; three key customers with next-day SLAs. Dependencies Municipal road access; local police crowd-control posture; contractor availability. Obligations Duty of care to employees and drivers; contractual SLA penalties.

Scoring Likelihood 3 Moderate based on incident density in the city over the past 24 months; Impact 4 Major given SLA penalties and backlog risk; Inherent 12. Controls Private security presence, alternative gate, flexible shift start, comms plan. Control effectiveness Partial; alternate gate often congested. Early warnings Permits filed for protests; union announcements; police advisories. Owners Risk Owner Regional Ops Director; Control Owner Site Security Lead. Appetite Tolerate residual at Moderate or lower. Response If protests announced within 48 hours and expected crowd over 1,000, pre-stage staff for earlier shift, reroute carriers to gate 2, notify affected customers. Residual 8 after controls. Next review 90 days or on tripwire.

This textual format mirrors a spreadsheet or ticketing record and adapts easily to your environment. If you prefer a prebuilt layout, start with the “risk register template” fields above, then connect monitoring so indicators and tripwires update without manual hunting. Platforms like Seerist Monitor, Verified Events, and city-level analysis help localize likelihood and what to watch next, while AskAnna accelerates first drafts of updates and decision notes. When you are ready to operationalize the register inside workflows, see Operational risk management software.