Mechanisms exist to maintain a risk register that facilitates monitoring and reporting of risks.
Does the organization maintain a risk register that facilitates monitoring and reporting of risks?