Which of the following statements correctly describe the risk management lifecycle process?

The risk management lifecycle, as aligned with industry standards like ISO 31000 and implemented in ServiceNow, follows a logical sequence. The process begins with 'Identify and Plan,' where risks are cataloged in the risk register. The next phase is 'Assess,' where risks are analyzed and scored based on impact and likelihood. Following assessment, the 'Control' (or Respond) phase involves implementing mitigation strategies. Finally, the 'Review' (or Monitor) phase is a continuous process of evaluating the risk posture and control effectiveness.

A. Access, Identify and Plan, Control, Review: "Access" is not a standard phase in the risk management lifecycle, and this option omits the critical 'Assess' phase.
B. Control, Review, Assess, Identify and Plan: This sequence is illogical and reversed. Identification and assessment must precede the implementation of controls.
D. Identify and Plan, Review, Assess, Control: This order is incorrect because a risk must be assessed before the response and its effectiveness can be reviewed.

- ServiceNow Product Documentation. (2023). Risk management in GRC. [Online]. Available at: docs.servicenow.com. The overview of the Risk Management application describes the process flow, which aligns with Identify, Assess, Respond (Control), and Monitor (Review).

- ServiceNow. (2022). Risk Management Fundamentals. [Courseware]. Now Learning. The official training materials for GRC consistently present the lifecycle as Identify, Assess, Respond, and Monitor.