Which statement correctly describes the risk management lifecycle process?

Which statement correctly describes the risk management lifecycle process?

• A. Access, Identify and Plan, Control, Review
• B. Control, Review, Assess, Identify and Plan
• C. Identify and Plan, Assess, Control, Review
• D. Identify and Plan, Review, Assess, Control

Answer: (C)

The risk management lifecycle starts by identifying what needs protection and planning how to handle risks, then moves to evaluating how big the risk is (assessing), followed by taking actions to reduce or control that risk, and finally reviewing the results to learn and adjust. This order makes sense because you first establish scope, objectives, and methods so you know what you’re protecting and how you’ll approach it. Without planning, the assessment might look at the wrong things or miss criteria that matter to the business. After planning, you quantify risk through assessment to understand likelihood and impact, so you can target the right controls. Implementing controls comes next, based on the risk picture you’ve established, and the review step closes the loop by checking effectiveness and informing any needed changes. So the sequence Identify and Plan, then Assess, then Control, then Review is the logical flow. Other sequences skip or reorder these steps in ways that undermine understanding of risk, misallocate resources, or delay learning from outcomes.

The risk management lifecycle starts by identifying what needs protection and planning how to handle risks, then moves to evaluating how big the risk is (assessing), followed by taking actions to reduce or control that risk, and finally reviewing the results to learn and adjust. This order makes sense because you first establish scope, objectives, and methods so you know what you’re protecting and how you’ll approach it. Without planning, the assessment might look at the wrong things or miss criteria that matter to the business. After planning, you quantify risk through assessment to understand likelihood and impact, so you can target the right controls. Implementing controls comes next, based on the risk picture you’ve established, and the review step closes the loop by checking effectiveness and informing any needed changes.

So the sequence Identify and Plan, then Assess, then Control, then Review is the logical flow. Other sequences skip or reorder these steps in ways that undermine understanding of risk, misallocate resources, or delay learning from outcomes.