Which of the following is NOT a typical step in a risk management process?

• A. Identify hazards, assess risk, develop controls, implement controls, supervise and review.
• B. Identify hazards; assess risk; implement controls; develop controls; supervise and review.
• C. Identify hazards, assess risk, develop controls, supervise and review, implement controls.
• D. Identify hazards, assess risk, monitor and document performance.

Answer: (D)

Risk management follows a cycle where you identify hazards, assess the risk, develop controls to reduce that risk, implement those controls, and then supervise and review to ensure they’re effective. That sequence moves from understanding risk to actively reducing it and then checking how well the controls work.

Choosing the option that starts with hazards and risk assessment but then shifts to monitoring and documenting performance without first developing and implementing controls misses a essential part of the process. You can’t effectively monitor outcomes if there aren’t controls in place to influence those outcomes. Monitoring and documenting performance is important, but it belongs with supervising and reviewing the ongoing effectiveness of implemented controls, not as a standalone early step.