Question

A privacy solutions engineer inherits a privacy risk register that lists 140 identified risks. During review, she notices that many entries have no assigned risk owner, several treatment actions are marked 'in progress' with no update in over 18 months, and duplicate risks appear under different processing activities. Management wants assurance that the register remains a reliable basis for reporting to the privacy steering committee. What should the engineer recommend FIRST to restore the register's value as a risk management tool?

Accepted Answer

Establish a periodic review and validation process that assigns each risk an accountable owner and updates status, likelihood, and impact

Answer

Delete all stale entries older than 12 months to reduce the size of the register before the next committee meeting

Answer

Replace the register with an automated GRC tool that ingests risks directly from vulnerability scanners

Answer

Re-score every risk using a new quantitative methodology to make the numbers more precise for the committee