Risk register
A living list of identified risks with likelihood, impact, owner and treatment plan.
A risk register is a core document in every management-system standard (ISO 27001, ISO 42001, SOC 2). Each entry includes the risk description, inherent likelihood and impact, treatment (accept, mitigate, transfer, avoid), owner and residual rating. Reviewed at least quarterly; the audit evidence is the review log, not just the list.