A CISO wants a single living record that lists each identified risk with its owner, likelihood and impact ratings, current mitigations, planned treatment, and review date, so it can be reported to leadership regularly. What should the organization maintain?
Select an answer to reveal the explanation.
Short Explanation
A risk register is the ledger for your risk program: every risk gets a row, an owner and a next review date. The heat map is a nice picture of the ratings, but it can't hold owners, mitigations and review dates. Watch out for that one; it's the closest-sounding trap.
Full Explanation
A risk register is the central record of identified risks and is meant to be kept current. Typical columns include the risk description, affected asset, owner, likelihood and impact ratings or score, existing mitigations, chosen treatment, target residual risk, status, and next review date. The register supports communication, because leadership and auditors can see the risk posture in one place, and it supports review, because entries are revisited on a schedule and as conditions change. A risk heat map visualizes ratings by plotting likelihood against impact; it is often generated from the register, but it does not hold ownership, mitigations, treatment plans, or review dates. An audit charter is a governance document that defines an audit function's authority, scope, independence, and reporting lines; it does not track individual risks. A vendor registry is an inventory of third-party suppliers used in vendor risk management; it may feed risks into the register, but it is limited to vendors and does not track every organizational risk. Exam caveat: the register is a living document, so a one-time spreadsheet that is never reviewed fails the purpose even if its columns look right. Operational check: confirm every register entry has a named owner and a review date in the future, and flag any entry whose review date has passed.