In a risk assessment, what is the first step?

• A. Identify risks.
• B. Assess likelihood and impact.
• C. Prioritize risks.
• D. Plan mitigations.

Answer: (A)

Identifying risks first is essential because a risk assessment starts with discovering what could go wrong. You need to surface all potential threats, vulnerabilities, and hazards that could affect assets so you have a complete picture. Without this step, you wouldn’t know what to analyze or where to focus.

Once risks are identified, you can evaluate how likely each one is and how big an impact it would have. This analysis depends on knowing the specific risks that exist, so likelihood and impact come after identification.

After assessing, you typically prioritize risks based on their severity and probability, and then plan mitigations to reduce the most significant ones. This logical order—identify, analyze, prioritize, and then treat—keeps the process focused and actionable.