What components are involved in a formal risk assessment process?

• A. Documentation of decisions.
• B. Scoring, controls, and oversight.
• C. Public disclosure of all risks.
• D. No documentation.

Answer: (B)

A formal risk assessment uses a structured approach to identify risks, evaluate how serious they are, and manage them through ongoing monitoring. The key pieces here are scoring risks to quantify or rank their severity, implementing controls to reduce either the likelihood or impact of those risks, and maintaining oversight to track effectiveness and adjust actions over time. Risk scoring helps prioritize where to focus resources, while controls put concrete steps in place to mitigate the identified risks, and oversight ensures the process remains active and responsive.

Public disclosure of all risks isn’t a typical component of the internal risk assessment process and can raise issues around confidentiality and practicality. Documentation is essential in practice, but simply recording decisions isn’t enough by itself without the accompanying scoring and controls, along with ongoing oversight. So the combination of scoring, controls, and oversight best captures the main elements needed to assess and manage risk in a formal way.