What is a risk register and what information does it contain?

• A. A static list of compliance requirements.
• B. A living document of identified risks, their characteristics, owners, probability, impact, prioritization, and planned responses.
• C. A schedule showing risk mitigation timelines only.
• D. A budget line item for risk contingency.

Answer: (B)

A risk register is a living document used to capture identified risks and how they will be managed. It records each risk with a clear description, the likelihood of occurrence, the potential impact on project objectives, and who is responsible for addressing it. It also notes how risks are prioritized (often through a risk rating), what triggers signal when a risk is becoming active, and the planned responses or mitigation actions. Additional fields commonly include the status of the risk, target dates, and any contingency plans or actions taken. Because it’s updated as the project progresses and new risks emerge, it remains a current tool for monitoring and controlling risk throughout the project lifecycle.

Static lists of compliance requirements miss the dynamic, risk-focused nature of this tool. A schedule showing only mitigation timelines omits probability, impact, ownership, and ongoing monitoring. A budget line item for risk contingency focuses on cost rather than the full set of risk information and responsibility.