When an action is taken on a risk, which of the following is being done and which document needs to be updated?

Risk mitigation involves implementing measures to reduce either the likelihood or the impact of a threat before it occurs, which is an active response strategy. The risk register is the official repository that tracks identified risks, their owners, response strategies, and current status, and it must be updated whenever any action is taken on a risk. Keeping the risk register current ensures the project team and stakeholders have an accurate view of the risk landscape.

Accepting risk is a passive strategy where no action is taken, and 'risk review document' is not a standard PMI artifact - the risk register is the correct document.

Avoiding risk means changing the project plan to eliminate the threat entirely, not taking action on it; the 'risk review document' is also not a recognized standard term.

Exploiting risk is a response strategy for positive risks (opportunities), not negative risks, making it contextually incorrect for an 'action taken on a risk' implying a threat.