This article proposes a methodology for developing and maintaining a risk map and a riskregister to support the visualisation and prioritisation of risks in budget organisations and other controlobjects. Although risk maps are widely used in international risk management practice, including within theCOSO ERM and ISO 31000 frameworks, the article proposes their integrated application to public financialcontrol through probability–impact decomposition, a risk register that preserves institutional knowledge,and the analysis of objects’ interzonal migration. The integral risk score of each object is decomposed intoprobability (P) and impact (C) dimensions. Probability is derived from the compliance, operational, corruptionand information technology groups, while impact is derived from the budget and scale groups; the resultingscores are displayed on a 3 × 3 risk map. The risk register provides a centralised record of assessments andrelated decisions for all objects and assessment periods and is maintained under the “four-eyes” principle.By preserving assessment histories, the register reduces the risk of losing information about objects notincluded in the audit plan. Historical data stored in the register enable interzonal migration analysis andsupport the transformation of planning from a static annual document into a continuously updated process.The principal methodological contribution of the study lies in integrating the risk register with interzonalmigration analysis.