Which term is used to catalog identified risks and their analyses for governance?

• A. Continuous risk and control monitoring
• B. Business case
• C. Risk register
• D. Penetration test

Answer: (C)

When governance needs a clear view of risk, the term used to catalog identified risks and their analyses is the risk register. This central record lists each risk with its description, likelihood, impact, and overall risk rating, along with who owns it, the current controls in place, planned mitigation actions, target dates, and residual risk. Having this structured repository lets leadership see the organization’s risk posture, assign accountability, and track remediation efforts over time to ensure responses stay aligned with strategic goals.

Other options describe different activities: continuous risk and control monitoring refers to ongoing oversight of controls rather than maintaining the catalog itself; a business case justifies a project or investment; a penetration test is a security assessment to identify vulnerabilities.