What describes a risk register and its ongoing maintenance?

• A. A fixed risk list that is reviewed only when a crisis occurs.
• B. Updated only at project milestones.
• C. A list of risks without any categorization or mitigation details.
• D. A live list of risks with owner, probability, impact, and mitigations; update regularly, review in risk meetings, track actions.

Answer: (D)

A risk register is a living, actively managed document used to identify, assess, and respond to risks in a project. It should list each risk with who owns it, the probability of occurrence, the potential impact, and the planned mitigations or responses. It must be updated regularly as new risks emerge or as risk levels change, and it should be reviewed in risk meetings to ensure visibility and accountability. Tracking the actions tied to each risk ensures that mitigation steps are carried out and their effectiveness is monitored.

This is better than a fixed list that’s reviewed only during crises, which misses ongoing changes; or something updated only at milestones, which ignores fluctuations between checkpoints; or a list that lacks categorization and mitigation details, which makes it hard to manage and respond to risks effectively.