Following an information security risk assessment of a critical system, several significant issues have been...

Entering identified risks into the organization's risk register ensures that they are documented, tracked, assigned, and addressed. Without recording in the risk register, there’s no formal mechanism to manage, treat, or monitor the risk.

“The risk register is the central repository for tracking all known risks, their status, and treatment plans.”

— CISM Review Manual 15th Edition, Chapter 2: Information Risk Management, Section: Risk Response and Risk Register*