Which activity does the risk management professional perform immediately after obtaining internal and external information about the organization?

Immediately after obtaining a wide range of internal and external information, the risk management professional must organize it. This step is crucial for transforming raw, unstructured data into a coherent and manageable format. Organizing the information, often by categorizing it using frameworks like PESTLE (for external context) or SWOT, is a necessary prerequisite for the subsequent step of analysis. Effective analysis cannot be performed on a disorganized collection of data; it requires a structured foundation to identify patterns, relationships, and potential risks accurately. This aligns with the logical progression from data gathering to data interpretation within the risk management process.

A. Analyze the information.

Analysis is performed on organized information, not raw data. It is the logical step that follows the organization of collected facts.

C. Prioritize the information.

Prioritization occurs after analysis, as one must first understand the information's meaning and implications to determine its relative importance.

D. Report the information.

Reporting is an output activity that communicates findings after information has been organized, analyzed, and evaluated, not the immediate step after collection.

---

1. ISO 31000:2018, Risk management — Guidelines. The standard specifies the process flow where "Establishing the context" (Clause 6.3) is the precursor to "Risk assessment" (Clause 6.4), which begins with risk identification and analysis. For the vast amount of information gathered in Clause 6.3 to be a usable input for the analysis in Clause 6.4.3, it must first be logically structured and organized.

2. Purdy, G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal, 30(6), 881-886. https://doi.org/10.1111/j.1539-6924.2010.01442.x. This foundational article on ISO 31000 describes establishing the context as defining the parameters for managing risk. This definition process inherently involves structuring and organizing the gathered information to make it meaningful before analysis can commence (p. 884).

3. Leitch, M. (2010). ISO 31000:2009—The new international standard on risk management. Risk Analysis: An International Journal, 30(6), 887-892. https://doi.org/10.1111/j.1539-6924.2010.01426.x. In discussing the practical application of establishing context (Section 5.3 of the 2009 standard, now Clause 6.3 in the 2018 version), the paper implies that the collected data must be synthesized and structured to define the criteria against which risks will be evaluated, a step that logically precedes formal analysis (p. 889).