How should you document a risk assessment to ensure usability and compliance?

• A. Include scope, identified hazards, risk levels, controls with owners and dates, residual risk, review intervals, and sign-offs.
• B. List only the final risk rating and sign-off date.
• C. Include training schedules only.
• D. Exclude ownership information to protect privacy.

Answer: (A)

To be usable and compliant, risk assessment documentation should be a complete, structured record that anyone can read and verify. Include the scope to define boundaries, identified hazards to show what was considered, risk levels to quantify severity and likelihood, and controls with owners and dates to assign accountability and track progress. Residual risk shows what remains after controls, guiding further actions. Explicit review intervals ensure the assessment stays current, and sign-offs provide formal approval and traceability. This combination creates an auditable, action-oriented document that supports both practical use and regulatory or standards compliance. If you only record the final risk rating and a sign-off, you lose the context, accountability, and the ability to verify what actions are required or completed. Training schedules alone omit the risk evaluation and control measures. Excluding ownership information weakens accountability and makes it harder to follow up on who is responsible for each control.