Which framework should we follow — ISO 31000, COSO ERM, or NIST RMF?

They are complementary rather than competing. ISO 31000:2018 is the international general-purpose risk-management standard. COSO ERM (2017) is more enterprise- and finance-oriented and is widely referenced for SOX-style controls. NIST SP 800-37 Rev. 2 (RMF) is the U.S. federal information-security standard. Most regulated organisations map controls across more than one.

Is a risk register required by any of these standards?

ISO 31000:2018 does not mandate a specific artefact called a 'risk register' but does require recorded information about risks, owners, and treatments. COSO ERM expects similar documentation. NIST RMF requires authorisation packages with risk decisions documented. The form varies; the recorded ownership and follow-through requirement does not.

How does the IIA Three Lines Model affect risk-register design?

The Three Lines Model (IIA, revised 2020) separates operational risk ownership (first line), risk and compliance functions (second line), and independent assurance (third line). For a register to support all three, the underlying record needs shared, current, and auditable data — not parallel copies in different tools.

Why Risk Registers Fail When Nobody Owns the Follow Through

An insight on why risk registers fail when nobody owns the follow through from CodeCraft Enterprise.