Which statement best describes risk prioritization in risk management?

• A. Ranking identified risks by severity and likelihood to focus mitigations on high-priority risks.
• B. Randomly selecting risks to address first.
• C. Ignoring likelihood and focusing only on cost.
• D. Addressing only regulatory compliance risks.

Answer: (A)

Risk prioritization ranks risks by how likely they are to occur and how severe their consequences would be, so mitigations are directed at the highest-priority threats. By using a likelihood-and-impact view—often shown in a risk matrix—teams allocate resources to reduce the biggest risks first, ensuring efforts produce the greatest overall benefit and aligning actions with the organization’s tolerance for risk. This approach also helps decide when to accept, transfer, or avoid a risk and how quickly to act.

Randomly selecting risks would waste resources and leave major threats unaddressed. Ignoring likelihood and focusing only on cost misses the main drivers of risk, since some costly risks might be unlikely while frequent, lower-cost risks can still cause significant problems if not mitigated. Focusing only on regulatory compliance narrows attention to a subset of risks and overlooks other important operational, strategic, or safety threats.