Negative risks are recorded in the risk register. The risk register includes all identified risks, positive or negative, and is used to track and manage these risks throughout the project lifecycle. The risk management plan outlines the approach to managing risks, but it is the risk register that houses the specific entries for individual risks.