Risk management:
Identify risks →
Analyze (likelihood × impact) →
Treat (accept/transfer/avoid/mitigate) →
Monitor and
Review. Document in risk register.
Treatment options: Avoid (eliminate the risky activity), Mitigate (reduce likelihood/impact with controls), Transfer (insurance, contracts), Accept (document and acknowledge). No treatment = negligence. Risk management is an ongoing process — risks change as the environment changes.