Which is recorded in the ‘risk register’?

A.
Events that have already occurred

B.
Organizational risk appetite and capacity

C.
Risk management practices within an organization

D.
Threats and opportunities