I'm wrestling with what must be a common problem. Invidual project managers can record a high impact/high probability risk within their own project and then manage it. If the project itself isn't particularly critical to the organisation, what rules should be used to promote an individual project risk up onto the corporate risk register for global visibility? Simply its raw score isn't the answer. How do we stop corporate risk registers getting too big and too bland in a risk averse blame culture? How can corporate risk registers really add value?