Which of the following BEST supports the management of identified risk scenarios?

Collecting risk event data is important for analysis and lessons learned but is a reactive measure after an event occurs, not the primary tool for managing identified risk scenarios proactively.

A risk register is a central repository for documenting all identified risks, their characteristics (e.g., likelihood, impact, owner), current status, and planned or implemented mitigation strategies. It provides a structured way to track and manage risk scenarios throughout their lifecycle, ensuring continuous oversight and informed decision-making.

Using key risk indicators (KRIs) helps monitor changes in risk levels, but the risk register is the actual tool for systematically listing, tracking, and managing the scenarios themselves.

Defining risk parameters (e.g., appetite, tolerance) sets the context for risk management, but the risk register is the operational tool for managing the identified scenarios within those parameters.