What distinguishes risk assessment from risk management?

• A. Risk assessment creates a project budget; risk management tracks vendor contracts.
• B. Risk assessment monitors network traffic; risk management writes incident reports.
• C. Risk assessment defines password policies; risk management monitors user activity.
• D. Risk assessment identifies threats, vulnerabilities, likelihood, and impact; risk management prioritizes and mitigates risks over time.

Answer: (D)

The main distinction is that risk assessment identifies and analyzes risks, while risk management handles prioritization and mitigation over time. A risk assessment looks at what could go wrong, catalogs the threats and vulnerabilities, and estimates how likely those risks are and how severe their impact would be. This creates a clear view of the risk landscape so decisions about protections can be grounded in evidence.

Risk management takes that information and translates it into action. It prioritizes which risks to address first, selects and implements controls, and continuously monitors and adjusts those efforts over time to reduce overall risk.

The other options describe activities that are about budgeting, monitoring, reporting, or enforcing policies, rather than capturing the analysis-to-action lifecycle that distinguishes assessment from ongoing risk reduction and governance.