CAPM Practice: Demonstrate an understanding of project management planning

A risk register is used to document identified risks along with their characteristics (probability, impact, category), potential responses, assigned risk owners, and current status. Devi should proactively document this potential risk, assess it, and plan response strategies even before it occurs. This allows the team to be prepared if the risk materializes.

**Why not A:** While escalation to the sponsor may eventually be appropriate for certain high-impact risks, the first action should be to document the risk properly in the risk register with its probability, impact, and response strategies. Immediate escalation without proper analysis bypasses the risk management process.

**Why not C:** Waiting for a risk to materialize before documenting it defeats the purpose of proactive risk management. The risk register is designed to capture potential risks before they occur, allowing the team to prepare responses in advance. Waiting creates unnecessary exposure.

**Why not D:** External vendor risks are legitimate project risks that belong in the risk register. The source of a risk (internal or external) does not determine whether it should be tracked. Vendor-related risks can significantly impact project outcomes and must be managed proactively.