← Back to concept explainers

Concept Fable

Risk Register

Conclusion first:A Risk Register is a continuously maintained list of risks, recording identified risks, owners, likelihood, impact, mitigation measures, residual risk, acceptance status, review cycle, and current progress. After an enterprise Agent goes live, risks change with models, data, permissions, customer scenarios, and external regulations. The risk register provides a common source of truth connecting risk assessment, control owners, risk owners, audit, management reporting, and go-live decisions.

Risk Register · Risk Management

Read the story first. There is no rush to give a definition here; let the question grow on its own first.

Fable

The red register beside the sea chart keeps storms from existing only in rumor

The port fleet relied on the old captain's experience to go to sea. Where the hidden reefs were, which season had headwinds, and which routes were likely to encounter pirates—everyone listened to him, but rarely wrote it down. As long as the old captain was there, the fleet seemed stable.

After the new captain took over, his first voyage ran into an undercurrent on the old route. He knew "it's dangerous over there," but not how dangerous, when it would appear, who was responsible for detouring, or how to remedy it if they strayed in. Rumors can't save a ship.

The shipowner first had everyone meet to share more experience. The meeting was lively, but after it ended no one still remembered the status of each risk. The second repair was to write all worries into one long list, but with no levels, owners or handling plans, no one knew which to manage first.

The old accountant made a red ledger. For each risk, he wrote down the source, possible consequences, probability of occurrence, degree of impact, owner, mitigation measures, trigger signals, and review date. Hidden reefs, headwinds, pirates, and water shortages were no longer lumped together under a single "be careful."

At the first review, everyone found that some risks had already been lowered by the new lighthouse, some had risen because of the new route, and one spare-sail risk with no owner was about to cause an incident. The red ledger turned risk from rumor into a manageable object.

Later, the fleet consulted the red ledger before setting out and updated it after returning. The shipowner understood that risk does not disappear just because it is written down, but only when it is registered, assigned, prioritized and reviewed will it stop hiding in verbal experience waiting to hurt someone.

The red book also changed meetings. In the past, everyone argued over who had more experience; now they first look at high-impact, high-probability, unowned items, then decide budget and action. There is less emotion and clearer priorities.

When the fleet later encountered new pirate leads, it did not just shout about danger verbally, but added them to the red book, designating an investigator and a review date. Risk management thus became a continuously maintained account, not a story remembered only after something went wrong. Later the old captain retired, and the red book remained. The new captain would still have his own judgment, but did not have to start groping from rumors. An organization remembering risk is more reliable than an individual remembering risk. The red book gave risk a name, an owner and a time for the next check. When the storm really came later, the fleet did not argue on the spot, but activated the contingency plan according to the red book. This made preparations come before the disaster itself. It let experience no longer leave with the person.

Reveal

This story is about: risk register

A Risk Register is a continuously maintained list of risks, recording identified risks, owners, likelihood, impact, mitigation measures, residual risk, acceptance status, review cycle, and current progress. After an enterprise Agent goes live, risks change with models, data, permissions, customer scenarios, and external regulations. The risk register provides a common source of truth connecting risk assessment, control owners, risk owners, audit, management reporting, and go-live decisions.

What matters is that it is not just a term, but a structural problem that repeatedly appears in real AI / Agent systems. Understanding it lets you judge when to add a model, when to change a process, and when to add governance.

Metaphor mapping

  • Old captain's experience: risk knowledge scattered across human minds
  • Shouting precautions: untraceable one-off risk communication
  • Medicine boat delay: a business event triggered by multiple risks at once
  • Red Book: Risk Register
  • Description, likelihood, impact, owner: the core fields of a risk register
  • Mitigations and residual exposure: control plan and residual risk
  • Review dates and status: the cadence of ongoing risk governance

Andy Ren Xu's judgment

The practical value of this concept is that it helps you break "AI features that look smart" into deliverable, verifiable, and governable units of work.

risk assessmentcontrol ownerresidual riskrisk acceptance

Related distinctions

This concept is easily confused with adjacent concepts; it is recommended to continue to the comparison page.

京ICP备2026014272号