A financial services company is implementing a formal risk management program. The security team has identified various risks and needs to track them systematically. They want to document each risk's likelihood, potential impact, current mitigation status, and assign accountability. The CISO has asked for a centralized system that will also allow monitoring of metrics indicating when risks are materializing. Which of the following should the security team implement?