A risk management strategy is the appropriate document to capture the current state and desired future state of organizational risk. It outlines the organization's approach to risk management, including goals, objectives, and the plan to transition from the current state to the desired future state. The risk register is used primarily for logging and tracking risk events, but not for documenting the overall strategy and desired state changes.