Lists

Risk registers are a common method of recording and tracking risk items for safety-critical assets. 

They are a valid strategy for a ‘business as usual’ view of “we’ve recognised this risk” and “we’re doing this to control it”.

But when they get long and cumbersome, they aren’t that useful for prioritisation of tasks.  

It’s valid to use it as a tracking tool to show what’s been recognised and what’s being done about it.  But using solely the risk register for prioritisation and deciding where to allocate resources, usually doesn’t take into account the difficult judgement around the effectiveness of controls.