Risk register

Identified risks with likelihood × impact = inherent score, reduced by linked-control effectiveness to a residual score. The kind of artifact ISO 27001 / NIST RMF auditors expect to see maintained.