How does risk assessment differ from risk management?

• A. Risk assessment identifies and analyzes risks; risk management implements controls and monitors risk over time.
• B. Risk assessment implements controls; risk management analyzes risks.
• C. Risk assessment is only for financial risks; risk management for security risks.
• D. Risk assessment is ongoing, while risk management is a one-time activity.

Answer: (A)

The main idea here is the sequence and purpose of actions in handling risks. Risk assessment is about spotting what could go wrong and evaluating how likely it is and how severe the impact would be. It creates a clear picture of the risk landscape. Risk management takes that information and turns it into action: it selects and implements controls to reduce risk and then continuously monitors and reviews those risks over time to see if the controls work and whether new risks have emerged. This ongoing cycle keeps the organization protected and adapting to change.

For example, in a project, risk assessment would identify potential issues like data breaches or downtime and estimate their probability and impact. Risk management would then implement safeguards such as encryption, backups, and monitoring, and periodically reassess to adjust controls as needed.

Other options misplace responsibilities or scope: one reverses who analyzes versus who implements controls; another narrows risk assessment to financial risks and risk management to security risks; another treats them as a one-time activity rather than ongoing processes.