What is the repository for all identified risks?

• A. Repository for all unidentified risks
• B. Repository for risk statements
• C. Repository for risk frameworks
• D. Repository for all identified risks

Answer: (D)

The central store for risks that have been identified is the risk register. This is the single place where every identified risk is documented with details such as description, owner, likelihood, impact, controls, and mitigation actions, enabling consistent assessment, prioritization, and monitoring over time. Other options describe things that aren’t the repository for identified risks: unidentified risks are not yet documented in a formal risk record; risk statements are just the narrative descriptions of risk; risk frameworks are the methodologies or structures used to evaluate risk, not the actual stored risks. So the best choice is the one that describes a repository for all identified risks, which matches how the risk register is used in IRM.