easyMultiple ChoiceObjective-mapped
CRISC Is the PRIMARY purpose of a risk register? Practice Question
Which of the following is the PRIMARY purpose of a risk register?
⚠ Common exam trap
Candidates often confuse the risk register's primary purpose (documentation and analysis) with its secondary uses (tracking remediation or compliance), leading them to select a plausible but incorrect option like A or D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To document identified risks, their analysis, and planned responses
The risk register is the central repository for documenting identified risks, their analysis (including likelihood and impact), and the planned responses. While it can be used to track remediation actions, its primary purpose is to serve as the authoritative record of risk information, enabling informed decision-making and ongoing risk management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To track the status of risk remediation actions
Why it's wrong here
This is a function of the register, but not its primary purpose.
- ✓
To document identified risks, their analysis, and planned responses
Why this is correct
The risk register is the central repository for risk information.
- ✗
To provide real-time alerts for risk events
Why it's wrong here
A risk register is not a real-time monitoring tool.
- ✗
To satisfy regulatory compliance requirements
Why it's wrong here
Compliance is a benefit, but the primary purpose is risk management.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is the PRIMARY purpose of a risk register in the risk identification phase?
easy- A.Assign risk owners
- ✓ B.Document identified risks and their characteristics
- C.Calculate risk scores
- D.Track remediation progress
Why B: The primary purpose of a risk register during the risk identification phase is to systematically document each identified risk along with its key characteristics, such as the risk description, cause, impact, and potential triggers. This foundational record ensures that all risks are captured before any subsequent analysis or response planning occurs, aligning with the CRISC domain of IT Risk Identification.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.