Risk registers are tools that help organizations document, monitor, and manage their third party risks. They typically include information such as the risk description, category, source, impact, likelihood, rating, owner, status, and action plan. Risk registers enable organizations to prioritize their risks, assign responsibilities, track progress, and report on their risk posture. According to the CTPRP Study Guide, 'A risk register is a tool for capturing and managing risks throughout the third-party lifecycle.It provides a comprehensive view of the organization's third-party risk profile and facilitates risk reporting and communication.'1Similarly, the GARP Best Practices Guidance for Third-Party Risk states, 'A risk register is a tool that records and tracks the risks associated with third parties.It helps to identify, assess, and prioritize risks, as well as to assign ownership, mitigation actions, and target dates.'2

CTPRP Study Guide

GARP Best Practices Guidance for Third-Party Risk