What is a risk assessment, and what are its common steps in POA practice?

• A. A routine inventory of assets only
• B. A compliance check with regulatory requirements
• C. An audit of incident response plans
• D. A systematic process identifying threats, vulnerabilities, and impacts to determine risk levels and prioritization; steps include asset identification, threat and vulnerability analysis, risk calculation, and treatment.

Answer: (D)

A risk assessment is a systematic process to identify threats, vulnerabilities, and potential impacts to an organization’s assets so you can determine risk levels and prioritize actions in protection of assets. In POA practice, this approach helps focus resources on the most significant risks rather than just cataloging what you have or checking compliance. The steps described—identifying what assets exist, analyzing what threats could affect them and where weaknesses lie, calculating risk by considering both likelihood and impact, and selecting treatments to mitigate or accept those risks—form the typical workflow. This turns informal concerns into a structured plan for controls and investments, aligned with protecting critical assets. By contrast, a routine asset inventory is simply listing items, a compliance check focuses on meeting rules, and an audit of incident response plans examines preparedness rather than the ongoing assessment and prioritization of risk across the asset base.