A third party risk register is best described as what?

• A. An inventory of the risk involved in outsourcing a specific service/activity, providing the sum of risks across all third parties.
• B. A list of all vendor contact details
• C. A contract repository
• D. A performance scorecard for vendors

Answer: (A)

A third party risk register is a centralized inventory that captures the risk exposure from outsourcing a specific service or activity, aggregating the risks across all third parties involved. It records details such as risk category, likelihood, impact, controls in place, residual risk, owner, and remediation status, providing a current view of overall exposure to help prioritize mitigation and oversight. This is different from simple vendor contact lists, contract repositories, or performance scorecards—the first is administrative contact information, the second stores contractual documents, and the third tracks delivery metrics. None of those alone convey the combined risk posture across the entire third-party ecosystem, whereas a risk register does.