Which statement best describes a core element of an enterprise risk management framework?

Which statement best describes a core element of an enterprise risk management framework?

• A. IT infrastructure optimization
• B. Only risk transfer
• C. Marketing plan and brand strategy
• D. Risk identification, assessment, mitigation, monitoring, governance, and communication

Answer: (D)

A core element of enterprise risk management is the continuous process that covers identifying risks, evaluating their likelihood and potential impact, deciding on and implementing actions to reduce or control those risks, monitoring them over time, ensuring appropriate governance oversight, and communicating risk information to stakeholders. This complete cycle is what makes ERM effective because it not only spots risks but also prioritizes them, acts on them, tracks whether those actions work, and keeps leadership informed. The other options focus on specific activities or narrow goals—such as optimizing IT infrastructure, which is a technology objective; risk transfer, which is just one possible risk response; or a marketing plan and brand strategy, which are strategic activities—not the framework for managing risk end-to-end.

A core element of enterprise risk management is the continuous process that covers identifying risks, evaluating their likelihood and potential impact, deciding on and implementing actions to reduce or control those risks, monitoring them over time, ensuring appropriate governance oversight, and communicating risk information to stakeholders. This complete cycle is what makes ERM effective because it not only spots risks but also prioritizes them, acts on them, tracks whether those actions work, and keeps leadership informed. The other options focus on specific activities or narrow goals—such as optimizing IT infrastructure, which is a technology objective; risk transfer, which is just one possible risk response; or a marketing plan and brand strategy, which are strategic activities—not the framework for managing risk end-to-end.