EC-Council 712-50 Exam - Topic 4 Question 128 Discussion

Definition of a Risk Register

A risk register is a key tool in risk management used to document, track, and manage risks throughout their lifecycle. It serves as a central repository for all identified risks, detailing their nature, status, and potential impact.

Purpose of a Risk Register

The primary purpose is to maintain a log of discovered risks. It provides a structured approach to risk documentation, ensuring that all risks are identified, recorded, and available for review and analysis.

The risk register typically includes:

Risk descriptions.

Risk owners.

Likelihood and impact assessments.

Mitigation measures and actions.

Explanation of Options

A . Maintain a log of discovered risks:This is the correct answer. The risk register's main function is to act as a comprehensive inventory of risks, ensuring visibility and traceability across the organization.

B . Track individual risk assessments:While the risk register may include information from risk assessments, its primary purpose is not to track these assessments individually but to log and manage risks holistically.

C . Develop plans for mitigating identified risks:Risk mitigation plans are a separate output of the risk management process. The risk register may document these plans, but developing them is not its primary purpose.

D . Coordinate the timing of scheduled risk assessments:Scheduling risk assessments is part of the broader risk management process, not the primary function of the risk register.

EC-Council CISO Best Practices on Risk Management Tools

The framework advises using a risk register to:

Ensure a single source of truth for organizational risks.

Facilitate communication between stakeholders regarding risk priorities.

Support decision-making by providing a clear picture of the organization's risk landscape.

Serve as a foundation for regular updates, reviews, and audits of risk management activities.

Conclusion

The primary purpose of a risk register is A. Maintain a log of discovered risks. By centralizing risk information, it helps organizations manage risks effectively and ensures a transparent, documented approach to risk tracking.