A structured list of risks with probability, impact, owner, and mitigations. Often part of or linked to the RAID log.