On projects that I have overseen, I have not had perfect success in delivering my vision of how a risk log should look at the project level, in that it should contain the highest six or seven threats facing the project and that lower level logs can and should be used by the various teams. The project level log quickly grows into a highly controlled deliverable as the original RAID question conveyed.
At the project level, I would have an individual assigned as the project's risk manager, who will over additional risk management roles at the task level. That person would encourage or cause the lower level risk managers to maintain their own risk logs and would "audit" them as necessary to ensure or facilitate compliance and reasonable efforts in this task. If the logs are poorly maintained, that becomes an action for the teams to cure, and that action would be overseen by the PMO. Also, based on the risk analysis at the lower levels, the project risk manager would have the authority of escalating an identified threat to the project level log and then managing that threat occurs at the highest level.
All this said, the culture of non risk based thinking, or what I refer to as risk management resistance, prevails, seems to be systemic across all projects, and is terribly hard to overcome.
If you were to survey your teams, I would suspect 100% of them would agree risk management is an important--maybe the most important--task to do on every project. However, we seem to want to avoid it, both folks who raise threats and those who need to hear them.
People prefer guarantees; we seem to be uncomfortable with uncertainty; and our eyes glaze over when we start talking statistics, probabilistic distributions, confiden..... Fell asleep, sorry.
We don't want to raise threats on projects we're delivering because it comes across as if we are not in control, it airs our dirty laundry, it transfers ownership of its mitigation to the risk escalator when, if not raise, we can blame force majeur or other stakeholders, and on and on. We are told there is no try but do, failure is not an option, pessimists are negative people with whom no one wants to work, etc. All of these are risk management killers.
On the other side, for those who need to hear the threats, we consequence those who raises them. We tell them to fix it because "this is why I hired you." And then we end up making them report to us on this threat several times a week, micro managing every step. And if the threat materializes, we blame the risk escalator no matter how hard and how rigorous the mitigating activities were while we reward the firefighter who made no attempts to predict and avoid rough waters ahead. In all, there are serious consequences raising threats.
For a solid, mature, and capable risk process, everything above needs to be the opposite of what occurs. Raising and mitigating risks need to be rewarded, even if mitigation fails; while surprises and the heroic fire fighting need to be "punished," even after successful recovery. The opposite seems to occur right now.
All of the solutions I have tried seems to run counter to how we sort of naturally respond with threats. I think the solution here is more about human psychology than it is around processes, tools, logs, etc. This is more of a rant than an answer but this is really a complex issue.