Enterprise risk

The register is the artifact

A risk that is not written down with an owner is not managed. Each entry carries:

The risk stated as a cause and consequence — "if X happens, then Y." "Cybersecurity" is a category, not a risk. "If an employee's credentials are phished, an attacker reaches customer records" is a risk you can do something about.
Likelihood and impact, on a stated scale, with the reasoning. The reasoning matters more than the score.
Current controls and an honest view of whether they work.
Residual risk after those controls — the number that actually matters and the one most often omitted.
A named owner. A person, not a department.
Treatment and a date.