Which of the following describes the risk management steps for an RME?

• A. Identify risks, assess likelihood and impact
• B. Implement controls before identifying risks
• C. Describe risk management steps: identify risks, assess likelihood and impact, implement controls, monitor, and document responses
• D. Monitor only after project ends

Answer: (C)

Risk management is an ongoing cycle that starts with identifying what could go wrong, then evaluating how likely each risk is and how big its impact would be, followed by putting in place safeguards, continuously monitoring the situation, and documenting how responses are handled. The best choice reflects this full sequence: identify risks, assess likelihood and impact, implement controls, monitor, and document responses. Each step supports the next: identification makes risks visible; assessment helps prioritize where to act; controls reduce exposure; monitoring checks that controls work and flags new or changing risks; and documenting responses creates a record for accountability and learning. The other statements miss essential parts or logical sequencing—for example, implementing controls before identifying risks, or monitoring only after the project ends—so they don’t describe a complete, effective risk-management process.