Exam CISM topic 1 question 1006 discussion

C. Identify the risk owner. Risk ownership is critical because the risk owner is responsible for deciding how to manage the risk. This individual or entity is accountable for taking appropriate actions, whether that involves accepting, mitigating, transferring, or avoiding the risk. Without identifying the risk owner, it's difficult to move forward with risk treatment or monitoring. While prioritizing risks is important, the next step after risk evaluation should be identifying the risk owner. The owner can then be responsible for prioritizing and addressing the risk.

Yep, after risk assessment (identification, analysis and evaluation) comes risk response/treatment. Now, I'm split between B and D, since the question says "risk" (singular), so what is there to prioritize (answer B). Then again, otpion D mentions just one of the possible risk treatment options (mitigation). Dunno, would go with B.

B. Prioritize the risk for treatment

Once you've identified and analyzed the risks, it's important to prioritize them based on their potential impact and likelihood. This prioritization helps in deciding which risks should be addressed first and how to allocate resources for risk treatment. After prioritizing the risks, you can then proceed to identify controls for risk mitigation, identify the risk owner, and establish a plan to monitor the risks.