Which of the following BEST describes the purpose of a risk register in the risk identification process?
-
A
To define the organization's risk appetite and tolerance levels
-
B
To serve as a centralized repository documenting identified risks, their attributes, and ownership
-
C
To replace the need for internal audit risk assessments
-
D
To calculate the financial impact of all known risks