MENU
What is one of the primary purposes of maintaining records in risk management?
The correct answer is B. To track risk management performance and provide an audit trail for verification. ISO 31000:2018 emphasizes that maintaining appropriate records is a fundamental element of effective risk management. Records support transparency, accountability, traceability, and continual improvement.
Risk management records enable organizations to track the effectiveness and performance of risk management activities over time. By documenting identified risks, assessments, treatment decisions, monitoring results, and reviews, organizations can evaluate whether risk management processes are working as intended and whether objectives are being achieved.
In addition, maintaining records provides an audit trail, allowing internal and external reviewers to verify that risk management decisions were made systematically, based on evidence, and in line with established criteria and governance requirements. This is particularly important for regulated industries and for demonstrating due diligence.
Option A is incorrect because records serve a broader purpose than communication alone; they support learning, verification, and improvement. Option C is incorrect because ISO 31000 explicitly recognizes that risks cannot be completely eliminated. Option D contradicts ISO 31000, as records complement---not replace---monitoring and review.
From a PECB ISO 31000 Lead Risk Manager perspective, well-maintained records are essential for governance, assurance, and continuous improvement. Therefore, the correct answer is to track risk management performance and provide an audit trail for verification.