Do you have a formal risk assessment policy or process?

Yes, we have a formal risk assessment policy. We conduct quarterly risk reviews including conducting business impact analysis on high-risk events, and keeping track of risks within Jira, our ticketing system. 

Samples of old risk register exports can be provided to select customers with signed NDAs, but not current versions as some risks may still be open.