What steps should be taken to create a risk assessment and risk plan?

A proper risk assessment and plan (A) requires:

Identifying risks – Recognizing potential threats.

Assessing probability and severity – Evaluating impact likelihood.

Developing contingency plans – Creating strategies to mitigate identified risks.

Stakeholder communication (B) is important but does not constitute a complete risk plan.

Adding extra time (C) does not directly address risk sources.

Project tools (D) help manage risk but do not replace systematic risk analysis.

Reference: ISO 31000 – Risk Management & ISO 41001 Risk Mitigation in Facility Management​