CRISC Information Technology and Security Practice Question
A company's risk management policy requires a risk register to be maintained. Which of the following is the primary purpose of a risk register?
⚠ Common exam trap
It's easy for candidates to confuse the risk register with other operational logs (e.g., audit findings or asset inventories) or assume its primary purpose is financial quantification, whereas the CRISC exam emphasizes its role as a comprehensive tracking and documentation tool for the entire risk management process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To document and track identified risks, assessments, and risk responses
The primary purpose of a risk register is to serve as a central repository for documenting and tracking all identified risks, their assessments (including likelihood and impact), and the corresponding risk response strategies. This ensures that risk management activities are transparent, auditable, and actionable throughout the risk lifecycle, aligning with the ISACA CRISC framework.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To assign financial values to all risks
Why it's wrong here
While risk registers may include financial impacts, quantification is not the primary purpose.
- ✓
To document and track identified risks, assessments, and risk responses
Why this is correct
This is the core function of a risk register.
- ✗
To record audit findings
Why it's wrong here
Audit findings are recorded in audit reports, not risk register.
- ✗
To provide a list of all IT assets
Why it's wrong here
Asset inventory is separate from risk register.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.