I've come across completely pointless risk registers in the private sector. A risk register is only useful if people do something about it.
I remember being involved with a large business where the risk register noted that a number of servers being used to run software that was essential to the company's services were old and in danger of hardware failure. The software needed extensive reworking before it could be moved to new servers. This was raised as a major risk. The manager in charge of the development team that would carry out the work was clear that there weren't enough developers to do this work as well as deal with paid-for work from customers. He therefore, armed with the risk register, asked for more developers. The COO said no and stated clearly that the developers were only to do paid-for work, not risk mitigation. A few months later one of the servers failed, causing major disruption. No prizes for guessing who got sacked - in case you need a clue, it wasn't the COO. After this, those who had been looking after the risk register gave up on it. The business concerned subsequently collapsed into administration.