Which of the is a set of systematic, deliberate, and actionable steps to manage risk?

According to ISO 31000:2018, the risk management process is the systematic and structured set of activities for managing risk. Clause 6 of the standard outlines this process, which involves the systematic application of policies, procedures, and practices to the activities of communication, consultation, establishing the context, risk assessment (identification, analysis, evaluation), risk treatment, monitoring, and review. This definition directly corresponds to a "set of systematic, deliberate, and actionable steps to manage risk." A process, by its nature, is a sequence of steps designed to achieve a specific outcome, which in this case is the management of risk.

A. Security: Security is a condition or a state of being protected against risk; it is an objective or outcome of risk management, not the set of steps to achieve it.

B. Control: A control is defined in ISO 31000 as a "measure that maintains and/or modifies risk." While controls are actionable, they are specific measures applied during the risk treatment step of the process, not the entire systematic process itself.

D. Vision: A vision is a high-level, aspirational statement about the future. It provides direction but lacks the systematic, actionable steps required for day-to-day risk management.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Clause 6, "Process": This clause details the entire risk management process, stating, "The risk management process involves the systematic application of management policies, procedures and practices to the activities of communicating and consulting, establishing the context, and identifying, analyzing, evaluating, treating, monitoring and reviewing risk." This directly supports "Process" as the correct answer.

Clause 3.1, Definition 3.8, "Control": This section defines a control as a "measure that maintains and/or modifies risk." This highlights that a control is a specific measure, a component within the broader process, rather than the process itself.

2. University of Queensland. (n.d.). Enterprise Risk Management Framework. UQ Policy and Procedure Library.

Section 3.1, "Risk Management Process": The document, based on ISO 31000, outlines the university's risk management process as a structured sequence of steps including: establishing context, identifying risks, analysing risks, evaluating risks, and treating risks. This reinforces that the "process" is the comprehensive set of systematic steps. (Available via UQ's public policy library).

3. Lalonde, C., & Boiral, O. (2012). Managing risks and learning in organizations. Safety Science, 50(4), 983-991.

Page 985: The article discusses the ISO 31000 framework, emphasizing that "The risk management process described in the standard includes a series of logical and systematic steps..." This academic interpretation confirms that the standard's core methodology for managing risk is termed the "process." (DOI: https://doi.org/10.1016/j.ssci.2011.11.005)