Managing your risk register

Lots of company's have risk registers. However, in a way that would make Nassim Nicholas Taleb, many of the omit high impact but unlikely events that actually do occur.

Take, for example, this story about JournalSpace. I expect they did have a risk register. And that it contained dealing with disgruntled employees. But it didn't include backing up their critical database - or the likelihood that a disgruntled employee would wipe all of their users data. The event has made the company apparently worthless.

But if you are going to manage risk, what are you doing about reputation risks online? Do you monitor your reputation? Manage the consequences? Take actions to mitigate the risks you face? Or just set aside some cash each year to manage the consequences of things going wrong (like Taleb)?