A risk register is a document that records and tracks the information about the risks that may affect the organization’s objectives, such as the risk description, category, source, cause, impact, probability, status, owner, response, etc.

When developing a new risk register, a risk practitioner should focus on risk identification. This is the process of finding, recognizing, and describing the risks that may affect the organization’s objectives, using various techniques, such as brainstorming, interviews, checklists, surveys, etc.

Risk identification helps to create a comprehensive and accurate list of the risks that need to be managed, and to provide the basis for the subsequent risk analysis and evaluation, risk response planning, and risk monitoring and control.

The other options are not the risk management activities that a risk practitioner should focus on when developing a new risk register. They are either subsequent or parallel to risk identification.

The references for this answer are:

Risk IT Framework, page 29

Information Technology & Security, page 23

Risk Scenarios Starter Pack, page 21