Which of the following is the PRIMARY purpose of a risk register?

While a risk register's contents inform risk appetite discussions, its primary purpose is not to *guide* the determination of risk appetite, but to *document* the risks themselves.

A risk register is a tool used to identify, assess, and track risks, effectively creating a detailed inventory. This inventory provides management with a clear, organized view of all potential threats and opportunities, their characteristics, and their current status.

Aligning risk scenarios to business objectives is a function of risk assessment and strategy, but the register's core purpose is the inventorying and tracking of those risks.

Monitoring the performance of risk and control owners is a function of risk management oversight, which uses the data from the risk register, but it's not the register's primary purpose.