Which two sub-steps are involved in making informed risk decisions?

• A. Determine the type of control - engineering, administrative, or PPE.
• B. Identify and assess risk control options - reject, avoid, delay an action, transfer, and compensate.
• C. Implement Controls
• D. Document the Process

Answer: (B)

Making informed risk decisions hinges on identifying all viable risk control options and then assessing them to see how effectively they reduce risk and what residual risk would remain. The control options listed—reject, avoid, delay an action, transfer, and compensate—show the kinds of responses you consider. By identifying what could be done and evaluating how each option changes risk, its impact on the mission, and the resources required, you can compare alternatives and choose the option that best balances risk reduction with mission success. Implementation and documentation come after this evaluation, which is why those other steps aren’t the two sub-steps described here.