What is a key step in performing a risk assessment and mitigation plan?

• A. Ignore risks and proceed.
• B. Document residual risk and contingency plans.
• C. Identify risks, estimate probability and impact, prioritize with a risk matrix, define mitigation actions, assign owners, monitor and revise.
• D. Assign owners but do not monitor risks.

Answer: (C)

A risk assessment and mitigation plan works best when you follow a systematic sequence: identify all potential risks, estimate how likely they are and how big their impact would be, prioritize them with a risk matrix, define concrete mitigation actions, assign owners, and then continuously monitor and revise the plan as things change. This approach ensures nothing is overlooked, focuses effort on the most significant threats, creates clear accountability, and keeps responses up to date as the project or environment evolves.

Choosing to ignore risks is unacceptable because it leaves surprises unchecked. Focusing only on documenting residual risk and contingency plans skips the essential steps of identifying and prioritizing risks and establishing ongoing ownership and monitoring. Assigning owners without monitoring means there’s no feedback loop to catch new risks or changes in likelihood or impact.