What is a risk register and what purpose does it serve in risk management?

• A. A risk register is a static summary of incidents to ignore.
• B. A risk register is a risk calendar for scheduling.
• C. A risk register is a living document that records identified risks, owners, assessments, controls, and actions to track and manage risk.
• D. A risk register is a financial ledger for risks.

Answer: (C)

A risk register is a living record of all significant risks a project or organization faces, along with who owns each risk, its assessed likelihood and impact, the controls in place, and any actions planned or completed. This keeps risk information current and centralized, so stakeholders can see where attention is needed, monitor mitigation progress, and maintain accountability. Because risks change over time, the register is regularly reviewed and updated, which helps with prioritizing responses and allocating resources. It supports decision-making by tying risk data to actions and monitoring results. The other descriptions miss key aspects: a static summary won’t capture updates, a calendar focuses on timing rather than risk detail, and a financial ledger emphasizes numbers rather than risk management actions.