The means of managing risk, including policies, procedures, guidelines, practices or organizational structures, is called what?

• A. Control
• B. Environmental risk
• C. Cyber and information security risk
• D. Business risk

Answer: (A)

In risk management, the means of managing risk are control activities. Controls are the measures an organization puts in place to reduce the likelihood of a risk event occurring or to lessen its impact. They come in many forms, including policies, procedures, guidelines, practices, and the way the organization is structured. For example, a security policy sets expectations, a change management procedure governs how changes are approved and tracked, and an access control mechanism limits who can do what. These controls can be preventive (stopping a risk before it materializes), detective (identifying when something goes wrong), or corrective (restoring control after an incident). The other options describe the types of risk themselves, not the mechanisms used to manage them, so they don’t fit as the term for the means of managing risk.