Which statement best describes the role of a risk register in governance?

• A. It tracks only realized losses from the previous year.
• B. It outlines the organizational chart.
• C. It lists all vendors and their risk ratings for procurement.
• D. It documents potential risks, their likelihood and impact; used to prioritize mitigation actions and allocate resources.

Answer: (D)

A risk register is a proactive governance tool that captures identified risks, assesses their likelihood and potential impact, and guides where to focus mitigation efforts and allocate resources. This makes it the best description because it explicitly lists potential risks, evaluates how likely they are and how severe their effects could be, and uses that information to prioritize actions and funding to address them. It’s not just about realized losses, not an organizational chart, and not a vendor list with risk ratings for procurement; it’s a living document used to anticipate challenges, assign owners, track controls, and inform resource decisions over time.