Which term describes the process of aggregating risk assessments to obtain a complete view of enterprise risk?

• A. Risk analysis
• B. Risk evaluation
• C. Risk assessment
• D. Risk aggregation

Answer: (D)

Aggregating risk assessments to obtain a complete view of enterprise risk is the process of risk aggregation. It involves combining results from multiple risk assessments across the organization—different departments, processes, and IT systems—to form a single, consolidated picture of overall risk exposure. This enables governance and management to see interdependencies, understand total risk appetite vs. tolerance, and make informed decisions at the enterprise level.

Risk aggregation is distinct from other terms because it specifically refers to pooling and harmonizing data from many sources. Risk assessment, by contrast, identifies and evaluates risks for a particular area. Risk analysis digs into the nature, likelihood, and impact of a risk item. Risk evaluation judges whether a risk level is acceptable based on criteria. Each of these can be part of the broader process, but the act of combining them to produce an enterprise-wide view is aggregation.