What are the steps of a risk assessment?

According to ISO 31000 and NIST SP 800-30, the risk assessment process consists of risk identification (finding and describing risks), risk analysis (understanding the nature, likelihood, and impact of risks), and risk evaluation (comparing analysis results against risk criteria to prioritize). These three steps form the distinct assessment phase, which is separate from broader risk treatment or mitigation activities.

This choice skips the identification step, which is the foundational first step where risks are discovered and cataloged; without identification, there is nothing to analyze or evaluate.

Classification and risk management are not the defined steps of a risk assessment; classification may be part of asset management, and risk management is the broader overarching process that encompasses assessment, not a step within it.

Mitigation (risk treatment) is a step that occurs after the risk assessment is complete, not a step within the assessment itself; substituting mitigation for analysis omits the critical analytical phase.