Outline a basic enterprise risk management (ERM) cycle and identify the key activities in each phase.

• A. Identify objectives; risk identification; risk assessment (likelihood/severity); risk response (avoid/mitigate/transfer/accept); control activities; monitoring and reporting; continuous improvement.
• B. Initiation; planning; execution; closing; each phase has irrelevant activities.
• C. Only identify risks; write a report; done.
• D. Vision; mission; values; governance; risk is outside.

Answer: (A)

The basic ERM cycle centers on a continuous loop that starts with aligning risk activities to what the organization is trying to achieve—setting objectives and understanding the business context. From there, you identify what could threaten those objectives. Next you assess each risk by estimating its likelihood and its potential impact, so you know which ones matter most. Based on that assessment, you decide how to treat each risk—avoid it, reduce it through controls, transfer it via insurance or outsourcing, or accept it if the residual risk fits the organization’s risk appetite. After choosing treatment, you implement the appropriate control activities to make it happen. The cycle then continues with ongoing monitoring and reporting to verify that actions are working and to inform leadership, feeding back into planning and driving continuous improvement. This approach is why the option listing the full sequence of objectives, identification, assessment, response, controls, monitoring/reporting, and continuous improvement best captures the ERM process. The other choices describe different concepts (for example, a project lifecycle), are incomplete (only identifying risks), or misplace risk outside governance, which doesn’t fit how ERM operates.