Which of the following establishes organizational checks and balances with a proper segregation of front, back, and middle office functions for effective risk management?

A risk response plan documents specific actions to address identified risks but does not create the organizational structures or segregation of duties between office functions.

Risk analysis is the process of assessing the likelihood and impact of identified risks, not the governance framework that defines organizational checks and balances.

A risk management plan describes how risk processes will be conducted within a project or organization but does not itself establish the governance structures or the front-middle-back office segregation described in the question.

Risk governance defines the framework of authority, accountability, and oversight structures through which an organization manages risk, including the formal separation of front office (business/revenue), middle office (risk oversight and measurement), and back office (settlement and operations) functions. This segregation prevents conflicts of interest and ensures independent control and verification across organizational units. Establishing these checks and balances is the core purpose of risk governance, not of any individual plan or analysis activity.