What information is typically contained in a risk register?

What information is typically contained in a risk register?

• A. A catalog of all IT assets and their purchase dates.
• B. A log of identified risks with probability, impact, owner, mitigations, and status.
• C. A plan for disaster recovery testing procedures.
• D. A list of service level targets for software applications.

Answer: (B)

A risk register is a living record that tracks each identified risk and how it’s being managed. The information typically included—likelihood and impact, who owns the risk, the mitigations or actions planned, and the current status—helps teams prioritize which risks to address and monitor over time. Seeing probability and impact together shows which risks pose the greatest threat, the owner assigns accountability, mitigations outline concrete steps to reduce risk, and the status reveals progress or changes in priority. The other options describe different things: a catalog of IT assets is an asset inventory, not a record of risks; a plan for disaster recovery testing procedures is about testing DR capabilities rather than tracking risks; and a list of service level targets focuses on performance goals for services, not on risk management.

A risk register is a living record that tracks each identified risk and how it’s being managed. The information typically included—likelihood and impact, who owns the risk, the mitigations or actions planned, and the current status—helps teams prioritize which risks to address and monitor over time. Seeing probability and impact together shows which risks pose the greatest threat, the owner assigns accountability, mitigations outline concrete steps to reduce risk, and the status reveals progress or changes in priority.

The other options describe different things: a catalog of IT assets is an asset inventory, not a record of risks; a plan for disaster recovery testing procedures is about testing DR capabilities rather than tracking risks; and a list of service level targets focuses on performance goals for services, not on risk management.