Which of the following statements is true of a Risk Response task?

A Risk Response task follows a defined lifecycle to track the implementation of a risk mitigation strategy. This lifecycle is managed by a state model (e.g., Draft, Awaiting Approval, Work in Progress, Closed) that is progressed automatically by a workflow or a Flow Designer flow. For example, when a user submits a task in the 'Draft' state, the workflow automatically moves it to 'Awaiting Approval' and generates the necessary approval records. This automation ensures a consistent and auditable process.

A. Only one Risk Response task can be related to a Risk at a time: Multiple response tasks can be created for a single risk to address different aspects of the response plan.
B. Only users with the riskmanager role or higher can be assigned to a Risk Response task: Tasks are assigned to individuals responsible for the work, who typically have the snrisk.user role.
C. The risk admin role is required to assign the Risk Response task: A risk manager or even a risk user (if they own the parent risk) can create and assign response tasks.

- ServiceNow Product Documentation, "Create a risk response task". This document describes the process and states of a risk response task, noting its progression from Draft to Awaiting Approval and other states, which is indicative of a controlling workflow or flow.

- ServiceNow Product Documentation, "Risk response and risk mitigation". The description of the process implies a structured lifecycle, stating "When a risk response task is created, it is in the Draft state. After you submit the task for approval, the state changes to Awaiting Approval." This automated state change is characteristic of a workflow.