In short
Silicon program risk management works when each risk is tied to the commitment it threatens and the evidence that shows it moving, so it is worked the hour the evidence changes rather than discussed at the monthly review. A risk register is a list; a held risk has an owner, a trigger in the data, a worked-out response and a date by which the response has to start. Tymeline holds risks that way, as part of holding the date.
Why registers fail
A register is written at the start and reviewed at intervals. The risks on it are real, but the trigger is a person noticing, and people are busy. Meanwhile the evidence of the risk arriving, a coverage number, a supplier's revised date, a lot on hold, sits in a tool nobody is watching for it.
A risk held to evidence
Tie each risk to the commitment it threatens and to the signal that shows it moving. Decide the response in advance, so when the signal moves the response starts rather than a discussion. Give the response an owner and a date it must start by. Tymeline reads the signals continuously and starts the response within the authority it has, with the approver brought in for anything consequential.