A risk register where all risks are rated identically provides no useful prioritization. Risk assessment must meaningfully differentiate severity to guide resource allocation and management attention. When everything is 'medium,' management cannot determine what requires immediate attention versus what can be accepted or addressed later.