To effectively support business decisions, an IT risk register MUST: