Your Risk Register Is a Living Document

Writing a risk register feels productive. Then it sits in a shared drive, untouched, while the world changes around it. A risk register you never revisit isn't a control. It's a diary entry.

AI tools change fast. Your vendor ships model updates. Your team finds new uses nobody planned for. A tool that handled internal drafts last quarter is now emailing customers. Every one of those changes can quietly retire an old risk and birth a new one, and your register knows nothing about it unless you tell it.

So put the review on the calendar: once a quarter, one hour, the people who actually use the tools. Three questions each time. What's new since last quarter — new tools, new uses, new vendor changes? Which risks got smaller, because we added safeguards? Which got bigger, because reality had opinions?

Retire what's handled. Add what's new. Reassign owners who've left. The document should look a little different every quarter. If it doesn't, you're not reviewing it honestly.

The value was never the first draft. It's the habit.

I explain frameworks; I don't give legal counsel.