What is the purpose of an IT risk register?

• A. To track marketing campaigns
• B. To catalog IT-related risks, assess likelihood and impact, assign owners, and track mitigation actions and status.
• C. To list all software licenses.
• D. To store employee training records.

Answer: (C)

The purpose of an IT risk register is to catalog IT-related risks, assess their likelihood and potential impact, assign owners, and track mitigation actions and status. It serves as a centralized, living document for managing risk across information systems, data, and operations. Each risk entry typically includes a description, estimated likelihood, potential impact, a risk rating, existing controls, residual risk, an action plan, the designated owner, and target dates. This structure helps teams prioritize what to address first, ensures accountability by naming responsible individuals, and provides ongoing visibility into remediation progress and risk trends for governance, reporting, and audits.

Other options describe records that serve different aims—tracking marketing campaigns, listing software licenses, or storing employee training records—rather than systematically managing IT risks and their mitigations.