As part of an ERM program, the CRO of the Walt Disney Company has evaluated the risks facing the time share properties the company owns on the big island of Hawaii. The CRO is particularly concerned that a tsunami could cause significant damage to the time share buildings. When completing the risk register, how should the CRO categorize the tsunami loss exposure?

It should be categorized as a financial risk.

It should be categorized as a regulatory$/$compliance risk.

It should be categorized as an operational risk.

It should be categorized as a strategic risk.

It should be categorized as a hazard risk.