CompTIA Security+ (SY0-701)Security Program Management and OversightEasy
A risk manager is building a document that will track every identified risk across the organization, along with its assigned owner, likelihood, impact rating, and current treatment status. Which of the following is the manager creating?
- ARisk matrix
- BBusiness impact analysis
- CRisk register
- DAudit report
Show answer & explanationAnswer & explanation
Correct answer: C. Risk register
A risk register is a living document that catalogs identified risks, their owners, likelihood and impact ratings, and mitigation status so they can be tracked and reviewed over time.
Why the other options are wrong
- A. A risk matrix visually plots likelihood vs. impact but does not track ownership or status over time.
- B. A BIA identifies critical processes and recovery priorities, not ongoing risk tracking.
- D. An audit report documents findings from a compliance or security audit, not ongoing risk tracking.
Risk Register
A document that catalogs identified risks along with their likelihood, impact, owner, and treatment status for ongoing tracking.
- Central repository for all identified organizational risks
- Includes risk owner, likelihood, impact, and mitigation status
- Reviewed and updated regularly as part of risk management lifecycle
Memory trick: A register keeps a running list — like a ledger of every risk.