What is risk management and which steps are typically part of a basic risk assessment?

• A. A method for maximizing profits by aggressive expansion.
• B. Process to identify, assess, mitigate, and monitor risks; steps include risk identification, analysis, prioritization, controls, and monitoring.
• C. A regulatory compliance checklist focused only on reporting.
• D. An IT project plan timeline with milestones.

Answer: (B)

Risk management is a structured way to handle uncertainty that could affect achieving objectives. In a basic risk assessment, you identify what could go wrong, evaluate how likely each risk is and how big its impact would be, prioritize the risks by their severity, put controls or actions in place to reduce or manage those risks, and then monitor the situation to see if conditions change. This description aligns with the option that defines risk management as a process to identify, assess, mitigate, and monitor risks, including steps like risk identification, analysis, prioritization, controls, and ongoing monitoring. The other choices don’t fit because they describe profit-focused expansion, a narrow regulatory checklist, or an IT project timeline, none of which capture the ongoing process of identifying and managing risk.