Answer (A) is correct . Risk retention is one possible strategy in response to risk, not a step in the risk management process.
Answer (B) is incorrect because Personnel identify and evaluate possible responses to risks, which include avoiding, accepting, reducing, and sharing risk. Management selects a set of actions to align risks with the entity’s risk tolerances and risk appetite.
Answer (C) is incorrect because Identified risks are analyzed in order to form a basis for determining how they should be managed. Risks are associated with objectives that may be affected.
Answer (D) is incorrect because Objectives must exist before management can identify potential events affecting their achievement.
|
