Every risk needs a date by which it will either have happened, or no longer be at risk of happening.

Agree this date and enter it in your risk register. It is not good practice to put ‘Ongoing’ under this column, so do try to quantify it if you possibly can.