Use this on a register that already exists; for a first register, build one instead. You get two files in a new folder, ./risk-register-hygiene-review/: a spreadsheet you can open in Excel with one line per problem found in the register and a proposed fix for each (findings.csv), and a one-page summary with the counts, the five problems that matter most and the questions for each owner (summary.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The register itself is never edited: owners decide each fix.

Inputs to gather

Read the register (spreadsheet, export from a compliance platform, or document), the risk method, the treatment plan, the acceptance records, the incident log, audit and penetration test findings, the asset or service inventory and the supplier list. Ask the reader: when was the register last reviewed as a whole, which teams or systems changed since, and is there a date by which it must be clean.

Step 1: check structure and ownership

For each entry, add a line to the findings spreadsheet (findings.csv) when:

The owner is a team, a tool or a departed person, not a role that can approve money or change a process.
One owner holds more than about a third of all risks; nobody can review that many.
Core fields are blank: scenario, inherent score, residual score, treatment decision, review date.
The entry is a topic ("ransomware", "GDPR") rather than a scenario with a cause and a consequence.

Step 2: check freshness

Flag entries whose last review is older than the cadence the method states (often 12 months for the whole register, quarterly for top-band risks). Flag treatment actions past their due date with no status change, acceptances past their expiry or with no expiry at all, and clusters of live acceptances on one asset or supplier whose combined exposure no single signer approved. Flag risks tied to systems or suppliers that no longer appear in the inventory or supplier list; those may be closed, or the inventory may be wrong. Propose a disposition for each: closed with a reason and date (the row kept, not deleted), re-linked to the surviving asset, or the inventory corrected.