Which sequence correctly lists the five steps of the risk management process?

Which sequence correctly lists the five steps of the risk management process?

• A. Identify risks; analyze frequency and severity; monitor and review results; select and implement risk control techniques; finance or retain risk.
• B. Identify risks; analyze frequency and severity; select and implement risk control techniques; finance or retain risk; monitor and review results.
• C. Analyze frequency and severity; identify risks; monitor and review results; select and implement risk control techniques; finance or retain risk.
• D. Monitor and review results; identify risks; analyze frequency and severity; select and implement risk control techniques; finance or retain risk.

Answer: (B)

This sequence reflects the logical flow of the risk management process, moving from discovering what could go wrong to confirming that the chosen actions actually work. Start by identifying the risks so you know what needs attention. Only after you know what risks exist can you assess them by looking at how often they could occur and how severe their impact would be. With that analysis, you can decide on and implement the appropriate risk control techniques to reduce or eliminate the risks you’ve prioritized. After controls are in place, you determine how to finance or retain any residual risk—that is, what portion you will keep or transfer after mitigation. Finally, you monitor and review the results to ensure the controls are effective and to make adjustments if new information emerges or conditions change. This last step is ongoing, feeding back into the earlier steps as needed. If you try to monitor before identifying risks, or analyze before identifying, the process would be illogical because you wouldn’t know what risks exist to analyze or measure. Similarly, starting with monitoring results before taking action ignores the need to identify, assess, and treat risks first.

This sequence reflects the logical flow of the risk management process, moving from discovering what could go wrong to confirming that the chosen actions actually work. Start by identifying the risks so you know what needs attention. Only after you know what risks exist can you assess them by looking at how often they could occur and how severe their impact would be. With that analysis, you can decide on and implement the appropriate risk control techniques to reduce or eliminate the risks you’ve prioritized. After controls are in place, you determine how to finance or retain any residual risk—that is, what portion you will keep or transfer after mitigation. Finally, you monitor and review the results to ensure the controls are effective and to make adjustments if new information emerges or conditions change. This last step is ongoing, feeding back into the earlier steps as needed.

If you try to monitor before identifying risks, or analyze before identifying, the process would be illogical because you wouldn’t know what risks exist to analyze or measure. Similarly, starting with monitoring results before taking action ignores the need to identify, assess, and treat risks first.