Most risk processes use a risk register to document the outputs. What is it, and why do we all need one?