Which statement is CORRECT about risk management in digital organizations?

ITIL 4 Digital and IT Strategy (DITS) describes risk management as a collective activity: “all relevant stakeholders should participate in identifying, analysing, and evaluating risks to ensure that nothing important is overlooked.” Engaging the full range of stakeholders (business, IT, partners, suppliers, customers) provides the broadest possible view of threats and opportunities and is therefore a core principle for risk management in digital organizations. The other statements mis-represent ITIL guidance: risk management is not limited to owned assets, does not always start with a current-state assessment, and risks can be either threats or opportunities, so not all unmanaged risks necessarily cause harm.

B. ITIL stresses consideration of risks to value co-creation across the ecosystem, not merely to assets the organization owns.
C. Risk identification can be triggered by strategic change, external events, or future scenarios—not solely by analysing the current state.
D. ITIL defines risk as “uncertainty of outcome,” which can be positive (opportunity) or negative; unmanaged positive risks may benefit the organization.

1. Axelos. ITIL 4: Digital and IT Strategy, 1st ed., TSO, 2020, section 6.3.2 “Risk management,” pp. 113-114 – stakeholder involvement statement.

2. Axelos. ITIL 4 Foundation, 1st ed., TSO, 2019, section 4.3.1 “Risk management practice,” p. 122 – definition of risk as positive or negative.

3. Axelos. ITIL 4: High Velocity IT, TSO, 2020, section 3.4 “Governance, Risk & Compliance,” p. 68 – emphasis on ecosystem-wide risk, not just owned assets.