The risk register includes root causes of risk. 1 is incorrect because the project team may contribute the root cause analysis, but the risk register is the component that stores the root cause of identified risk. 2 is incorrect because experts may contribute the root cause analysis, but the risk register is the component that stores the root cause of identified risk. 3 is incorrect because the project scope does not contribute or supply root cause of risks.