A risk register is a tool that records and tracks the risks associated with a project or an activity, such as developing consumer-based services using emerging technologies involving sensitive personal data. A risk register typically includes information such as the risk description, category, impact, probability, status, response strategy, and owner. Reviewing the risk register will enable the CIO to make the best decision for the customers, as it will help them to identify, assess, and prioritize the risks that may affect the security, privacy, and quality of the services, and to determine the appropriate actions to mitigate or avoid them. The other options are not as relevant, as they do not provide specific information about the risks involved in the project or activity. References: : CGEIT Review Manual (Digital Version), Chapter 4: Risk Optimization, Section 4.3:
IT Risk Management, Subsection 4.3.2: IT Risk Management Process, Page 156 : CGEIT Review Manual (Digital Version), Chapter 4: Risk Optimization, Section 4.3: IT Risk Management, Subsection 4.3.3: IT Risk Management Techniques and Tools, Page 158 : Capability Maturity Model and Risk Register Integration1