What is a risk register?

• A. Repository for all unidentified risks
• B. Repository for risk frameworks
• C. Repository for risk statements
• D. Repository for all identified risks

Answer: (D)

A risk register is the central, living catalog of risks that have been identified across the organization. It stores each risk with essential details—description, owner, likelihood, impact, and a risk rating—plus information about current status, evidence of controls, and any planned or completed mitigation actions. This makes it a single source of truth for monitoring risk over time, enabling prioritization, reporting to governance bodies, and tracking how controls reduce risk to acceptable levels. It’s not a place for unidentified risks, nor a repository of risk frameworks, nor only a collection of risk statements; the register’s value comes from recording identified risks and how they are being managed.