Which basic step in risk analysis should be performed last?

Which basic step in risk analysis should be performed last?

• A. Monitor and review
• B. Determine cost-effective strategy
• C. Identify threats
• D. Assessment and evaluation

Answer: (B)

Risk management is an ongoing cycle. After you identify threats and assess or evaluate the risks, the final step is to monitor and review. This phase keeps the process alive by tracking how well the controls are working, spotting any new or changing threats, and updating the risk assessment or treatment plan as needed. It effectively closes one cycle and can trigger the next, ensuring the organization stays protected over time. The other steps occur earlier in the process: identifying threats happens at the outset, assessment and evaluation are the analytical work that determines risk levels, and determining a cost-effective strategy is about choosing which controls to implement based on cost-benefit before those controls are put in place and monitored.

Risk management is an ongoing cycle. After you identify threats and assess or evaluate the risks, the final step is to monitor and review. This phase keeps the process alive by tracking how well the controls are working, spotting any new or changing threats, and updating the risk assessment or treatment plan as needed. It effectively closes one cycle and can trigger the next, ensuring the organization stays protected over time.

The other steps occur earlier in the process: identifying threats happens at the outset, assessment and evaluation are the analytical work that determines risk levels, and determining a cost-effective strategy is about choosing which controls to implement based on cost-benefit before those controls are put in place and monitored.