What is the process for determining and documenting the risk an enterprise faces?

• A. Risk scenario
• B. Risk awareness program
• C. Risk identification
• D. Threat event

Answer: (C)

The process of determining and documenting the risk an enterprise faces is risk identification. This first step in risk management involves discovering potential events or conditions—from both inside and outside the organization—that could affect objectives, and describing them in a structured way. It captures details such as what could happen, why it might occur, the potential impact, and who would own the risk, typically resulting in a risk register or inventory. This foundation enables later steps like evaluating and prioritizing risks and deciding on responses. A risk scenario is a narrative example used to illustrate how a risk could unfold, not the overall process. A risk awareness program is about educating stakeholders on risk concepts, not identifying specific risks. A threat event is a specific incident that could cause harm, rather than the process of identifying and documenting risks.