During an engagement planning session, which approach demonstrates proper risk mitigation?

• A. Avoid documenting any risk.
• B. Identify hazards, assess probability and impact, implement mitigations, and document residual risk.
• C. Assign risk to another unit without mitigation.
• D. Ignore residual risk after mitigations.

Answer: (B)

Applying a structured risk management process during engagement planning is essential. It starts with identifying hazards that could affect the engagement, then assessing their probability and potential impact to understand which risks matter most. After that, you implement mitigations to reduce either the likelihood or the consequences, and you document the residual risk—the amount of risk that remains after mitigations. This documentation is crucial because it shows what still needs monitoring and whether further actions are warranted. The approach described does exactly that: it covers identifying hazards, evaluating probability and impact, putting mitigations in place, and recording residual risk so leadership can review and accept or adjust risk levels. In contrast, avoiding risk documentation leaves stakeholders unaware of what could go wrong; transferring risk to another unit without actual mitigations doesn't reduce exposure or create controls; and ignoring residual risk after mitigations means you stop monitoring risk and might miss changing conditions that could elevate risk again.