Is it possible to monitor risks for for departments rather than projects?
Yes. Risk Register requires you to nominate one or more projects to act as containers for your risk issues, but there's nothing to prevent you from creating a project specifically to be the One True Risk Register. Alternatively, you could create a projects to act as containers for teams or system areas. You can store your risks in whatever project(s) you like. Since they are essentially a special type of Jira issue, you have complete freedom to associate them with Epics and Initiatives however you like. The benefit of this design is that each risk will travel along its own workflow independently of the workflow of the issue(s) it is linked to.
Related articles