The best way to increase the chances of a successful delivery of a new application and to assure the business management that IT has a plan in place for early identification of potential issues is to include business management on a weekly risk and issues report. A risk and issues report is a document that summarizes the current status, progress, and challenges of the IT project, as well as the actions and resources needed to address them. A risk and issues report helps to communicate and align the expectations and objectives of the IT and business stakeholders, and to facilitate timely and effective decision-making and problem-solving. A risk and issues report also helps to monitor and control the project scope, schedule, budget, and quality, and to ensure that the project delivers the desired value and benefits to the organization. The other options are not as effective as including business management on a weekly risk and issues report, although they may be part of the IT project management process or outcomes. Implementing a release and deployment plan, conducting comprehensive regression testing, and developing enterprise-wide key risk indicators (KRIs) are all activities that can help to ensure the quality and reliability of the new application, but they do not necessarily involve the business management or provide assurance for the early identification of potential issues. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.4.1, page 5-32.

An IT risk register is a document that records and tracks the significant IT risks that an organization faces across its various functions, processes, and activities. An IT risk register can help to provide a comprehensive and consistent view of the organization's IT risk profile, and to support the decision making and reporting of the IT risk management function1.
One of the data that must be updated to maintain an IT risk register is the expected frequency and potential impact of each IT risk. The expected frequency is the probability or likelihood of the IT risk occurring, based on historical data, statistical analysis, expert judgment, or other methods. The potential impact is the magnitude or severity of the consequences or outcomes of the IT risk, measured in terms of cost, time, quality, reputation, or other criteria2.
Updating the expected frequency and potential impact of each IT risk is essential for maintaining an IT risk register, because it can help to:
Evaluate and prioritize the IT risks based on their risk level, which is calculated by multiplying the frequency and impact Monitor and track the changes or trends in the IT risk exposure and performance over time Identify and implement the appropriate risk response strategies and controls, based on the risk level and the risk appetite and tolerance of the organization Report and communicate the IT risk status and progress to the stakeholders, using risk indicators, dashboards, or matrices3 The other options are not the data that must be updated to maintain an IT risk register, but rather the data that are used as inputs or outputs of the IT risk management process. Risk tolerance is the acceptable variation in the outcomes related to specific objectives or risks. Risk tolerance is used to measure the IT risk analysis and to guide the IT risk response. Enterprise-wide IT risk assessment is a process that identifies, analyzes, and evaluates the IT risks across theorganization. Enterprise-wide IT risk assessment is used topopulate the IT risk register and to inform the IT risk response. Risk appetite is the amount and type of risk that an organization is willing to accept in order to achieve its objectives. Risk appetite is used to guide the IT risk analysis and to align the IT risk response. References = Risk Register - ISACA Risk Analysis - ISACA Risk Register 2021-2022 - UNECE
[How To Conduct Business Impact Analysis in 8 Easy Steps - G2]
[Risk Appetite and Risk Tolerance - ISACA]
[Enterprise Risk Assessment - ISACA]
[CRISC Review Manual, 7th Edition]

According to the IT Risk Management - Basics and Best Practices article, one of the best practices for IT risk management is to keep the risk register up to date. A risk register is a document that records the identified risks, their causes, impacts, likelihood, responses, and status. A risk register is a vital tool for IT risk management, as it helps to track and monitor the risks throughout their lifecycle, and to communicate the risks to the relevant stakeholders. However, a risk register is only useful if it reflects the current situation and environment of the organization. Therefore, the risk register should be regularly updated to capture any changes in the risk profile, such as new risks, resolved risks, modified risks, or escalated risks. Updating the risk register will help to ensure that the risk management process is effective and efficient, and that the risk responses are appropriate and timely. References = IT Risk Management - Basics and Best Practices

According to the CRISC Review Manual (Digital Version), the primary goal of a risk awareness program is to reduce the risk to an acceptable level by increasing the knowledge and understanding of the risk among the stakeholders. A risk awareness program should:
Educate the stakeholders about the sources, types and impacts of IT-related risks Explain the roles and responsibilities of the stakeholders in the risk management process Promote a risk-aware culture that supports the risk appetite and risk tolerance of the organization Provide guidance and tools for identifying, assessing, responding and monitoring IT-related risks Encourage the reporting and escalation of risk issues and incidents Reinforce the benefits and value of effective risk management References = CRISC Review Manual (Digital Version), Chapter 4: IT Risk Monitoring and Reporting, Section 4.2: IT Risk Reporting, pp. 224-2251