Which of the following is NOT a step in the risk management process?

• A. Identify risk
• B. Analyze risk
• C. Implement controls
• D. Measure market share

Answer: (D)

Risk management focuses on finding, understanding, and controlling threats that could affect objectives. Identifying risk is essential because you can’t manage what you don’t see. Analyzing risk means evaluating how likely it is and how serious the potential impact would be, which helps you prioritize where to focus. Implementing controls is about putting measures in place to reduce either the chance of the risk or its consequences. Measuring market share doesn’t fit as a risk-management step because it tracks competitive position, not the process of identifying, assessing, and mitigating risks. In practice, risk management also includes ongoing monitoring and review of risks and controls, which isn’t represented by the other options.