How many risks do you manage actively out of your Risk Registry? And how many residual risks do you have there?
The answer is "it depends." It depends on your project size and the inherent "riskyness" of the project.
I primarily apply risk management on small-scale software projects. On these, I try to have at least 10-20 risks in total (including risks like "top person X gets hit by a truck"). Out of these, I work to make sure only a handful require active monitoring -- no more than five or six. Some additional risks may require residual monitoring.
If you brainstorm risks properly, you should be able to identify more than a hundred or two -- even on small projects. Keeping track of the top few, while delegating or ignoring the rest, is the only real way to manage.
If you really do have a lot of risks on your "hot list," you can always delegate so that the team shares the burden of monitoring for risks.