A primary function of the risk register is to provide supporting information for the development of an organization's risk profile, which is a comprehensive and structured representation of the risks that the organization faces. The risk profile helps the organization to understand its risk exposure, appetite, and tolerance, and to align its risk management strategy with its business objectives and context. The risk register is a document that records and tracks the identified risks, their causes, impacts, likelihood, responses, owners, and status. The risk register is an essential input for creating and updating the risk profile, as it provides the data and analysis of the risks that need to be prioritized and addressed. The other options are not the primary function of the risk register, although they may be related to it. The risk strategy is the plan and approach for managing the risks, and it is based on the risk profile. The risk process is the set of activities and tasks for identifying, assessing, responding, and monitoring the risks, and it is facilitated by the risk register. The risk map is a graphical tool for displaying the risks based on their impact and likelihood, and it is derived from the risk register. References = Risk Register: A Project Manager's Guide with Examples [2023] * Asana; Purpose of a risk register: Here's what a risk register is used for; Risk Register: Definition, Importance, and Elements!
- Bit Blog; What is a Risk Register? A Complete Guide | Capterra; Risk Registers: What Are They, When Should You Use Them, and Why?

Detailed Explanation:Real-time monitoring is a detective control, as it is designed to identify and report suspicious or unauthorized activities as they occur. Detective controls provide feedback to mitigate ongoing risks and serve as an integral part of incident response plans.

The most important characteristic of a key risk indicator (KRI) to enable decision-making is illustrating changes in risk trends, as it provides a clear and timely indication of the direction and magnitude of the risk level and exposure, and enables the stakeholders to take proactive and appropriate actions to address the risk.
The other options are not the most important characteristics, as they are more related to the monitoring, measurement, or identification of the risk, respectively, rather than the illustration of the risk trends. References = CRISC Review Manual, 7th Edition, page 110.

Risk management is the process of identifying, analyzing, evaluating, treating, monitoring, and communicating the risks that may affect the achievement of an organization's objectives. Risk management helps to optimize the risk exposure and performance of the organization, and support the business objectives and strategies. The primary reason to engage business unit managers in risk management processes is to enable better-informed business decisions, which are the decisions that incorporate the risk information and analysis into the strategic and operational choices of the organization. By engaging business unit managers in risk management processes, the organization can ensure that the business unit managers have the insight and understanding of the current and potential risks, their likelihood and impact, their interrelationships and dependencies, and their alignment with the risk appetite and tolerance. This can help the business unit managers to prioritize the risks, allocate the resources, select the risk responses, monitor the risk performance, and evaluate the risk outcomes. References = 5

A risk register is a document that is used as a risk management tool to identify and track risks that may affect a project or an organization1. A risk register also includes information about the risk responses, which are the actions taken or planned to mitigate or eliminate the risks2. Therefore, a risk register provides the best evidence that risk responses have been executed according to their risk action plans, as it shows the status and progress of the risk responses, the results and outcomes of the risk responses, and the feedback and lessons learned from the risk responses3. A risk policy review is not the best evidence that risk responses have been executed according to their risk action plans, as it does not provide specific information on the risk responses. A risk policy review is a process that involves checking and verifying that the organization's risk management policies are up to date, relevant, and effective4. A risk policy review can help to identify and address any gaps or issues in the risk management policies, but it does not show the details and performance of the risk responses. A business impact analysis (BIA) is not the best evidence that risk responses have been executed according to their risk action plans, as it does not provide specific information on the risk responses. A BIA is a process that identifies and evaluates the potential effects of a disruption on the critical functions and processes of an organization5. A BIA can help to forecast the impacts of a risk event, but it does not show the actions and outcomes of the risk responses. A control catalog is not the best evidence that risk responses have been executed according to their risk action plans, as it does not provide specific information on the risk responses. A control catalog is a document that lists and describes the controls that are implemented or planned to manage the risks within an organization6. A control catalog can help to document and communicate the controls, but it does not show the status and results of the risk responses. References
= 1: Risk Register: A Project Manager's Guide with Examples [2023] * Asana2: Risk Response Strategy and Contingency Plans - ProjectManagement.com3: Risk Register: Examples, Benefits, and Best Practices4: A brief guide to assessing risks and controls | ACCA Global5: Using Business Impact Analysis to Inform Risk Prioritization and Response6: [Control Catalogue - ISACA]