What is the purpose of a risk register in TPRM?

• A. To document risks, ownership, likelihood, impact, controls, and remediation status.
• B. To log only vendor names and contact details.
• C. To store budget and procurement data.
• D. To track software licenses.

Answer: (A)

In TPRM, a risk register serves as a single, organized record of all identified third-party risks. It captures what the risk is, who owns it, how likely it is to occur, the potential impact, what controls are in place, and the current remediation status. This centralization supports consistent assessment, prioritization, and oversight across the vendor portfolio. Because risk information is updated and assigned to owners with remediation timelines, leadership can monitor progress, report to stakeholders, and make informed decisions about risk treatment or vendor relationships. It isn't simply a log of vendor names or contact details, nor is it intended to store budgets, procurement data, or software licenses; those details may be relevant elsewhere, but the register’s primary purpose is to document risk characteristics and track remediation.