During a review, the information security manager finds that no entry in the information risk register has been updated in two years, although the business has since launched two online services and moved its payroll to a cloud provider. What should be done to BEST correct this?
Select an answer to reveal the explanation.
Short Explanation
A risk register is a living map, not a framed photo on the wall. When the business has moved and the map hasn't, you set up regular reviews with the risk owners and redraw it, and you don't hand the map to the auditors.
Full Explanation
A risk register supports decisions only while it reflects the current business and threat environment. New online services and a move to a cloud provider change assets, threats, vulnerabilities and third-party exposure, so the existing entries are almost certainly inaccurate. The correction is to establish a defined review cycle in which risk owners reassess their risks, combined with triggers that prompt updates when significant changes occur, and to capture the risks introduced by the recent changes now. A penetration test can reveal technical weaknesses, but it covers a narrow slice of risk, says little about business impact, and does not create a maintenance process. Rebuilding the register from a framework's control list confuses controls with risks; a control catalog describes protections, not the organization's specific exposures and their impact. Transferring maintenance to internal audit compromises audit independence, since auditors would then evaluate a register they maintain, and it removes ownership from the business. Exam caveat: the information security manager facilitates the process, while risk owners remain accountable for their entries. Operational check: confirm each entry shows a last-reviewed date and owner, and that change management or project intake triggers a register update.