Which statement about identifying controls for risk management is correct?

• A. It is optional and can be ignored
• B. It remains strictly a board-level concern
• C. It is primarily about documenting risks
• D. It assigns individuals or roles to manage specific risks, implement controls, and report results

Answer: (D)

Assigning ownership and accountability for controls is essential. It’s not enough to just recognize risks—you need people to own each risk, design or choose appropriate controls, implement them, and then report on how well they’re working. This creates clear responsibility, actionable steps, and a regular flow of information to governance.

That’s why the strongest statement is that risk controls are identified by assigning individuals or roles to manage specific risks, put controls in place, and report results. It reflects the full process: who is responsible, what will be done, and how performance is communicated.

Think about it in practice: in a procurement process, an owner ensures a specific control (like vendor due diligence, contract review, or approval workflows) is established, monitors its effectiveness, and reports metrics (such as vendor risk ratings or approval times) to the risk governance structure. Without ownership, controls can be implemented on paper but fail in reality. Without reporting, stakeholders can’t see residual risk or effectiveness.

The other options don’t fit because controls aren’t optional, they aren’t solely a board issue, and risk documentation alone doesn’t drive risk reduction without action and ownership.