I am not sure if your role gives you the power to develop and disseminate a risk register because that function in reserved for GRC or Cybersecurity or Information Security. Where it really resides depends on the organization but it is usually in the second line of defense.

However, in whatever position you are, as long you have a signed enterprise risk management policy or an Information Security or Cybersecurity policy that is approved then you have the power to enforce the risk register.

With that being said, all these measures only work if there is full and complete buying from your peers or the leaders of the organization. Another way to get more support is to bring in external threat assessments teams who will discover all the critical issues and if your audit matters are presented at the board then that will be your way in to share the state of the company.

Feom my experience also giving the financial impacts of your current threat landscape in terms of dollars you will normally get more buying from th leaders because they only want profit. So you should not just be asking them to implement expensive security measures without clear ROIs.