There is a way to tell within a minute whether a risk register is doing anything. Open it and look at the dates. If every row was last touched in the same week, that week was the week before an audit, and the register is a document about the audit rather than about the risk.
The reason is not laziness. It is that the register was never connected to a decision. A list nobody consults before approving work, awarding a contract or changing a process has no mechanism by which it could stay current — nothing makes anybody open it. The audit is the only force acting on the file, so the file moves once a year, in the direction of the audit.
The second symptom follows from the first: entries stop being risks and become categories. "Supplier risk." "Working at height." A category cannot be treated, because it does not say what happens. A risk that can be treated has three parts in it — a cause, an event, a consequence — and the moment it is written that way the treatment is usually obvious. "Because we hold one imported source for a compressor part, delivery can run weeks late, which stops the packing line" proposes its own answer: a second source, a minimum stock, a contracted lead time. "Supplier risk" proposes nothing, which is why it survives review after review.
Then there is the scoring. A five-by-five matrix with no written definitions does not measure risk, it measures the assessor. Two people score the same hazard differently and both are right, because nothing says what a likelihood of 4 means. Defining each level in a sentence — "expected several times a year", "a main line down for more than 24 hours" — costs an afternoon, and it is the difference between a number that can be argued with and one that cannot.
The most expensive failure is quieter than any of these. A control is recorded as effective because it exists on paper, residual risk is calculated from that, and the person who would have acted never learns the control was not working. Nothing in the register is false. It is describing a plant that does not exist, and the decision-maker is reading it as though it describes theirs.
None of this is fixed by buying software, and none of it is fixed by certification: ISO 31000 is a guideline, and no organisation is certified against it. What changes a register is giving it a job. Tie each entry to the objective it threatens, put one person's name on it, add an indicator that moves before the event rather than counting it afterwards — and review it on a date already in the calendar, inside a meeting that happens anyway. A separate review that has to be convened is the first one cancelled.
When was the last real change to your risk register — who made it, and why?