A recent risk workshop has identified risk owners and responses for newly identified risk scenarios. Which of the following should be the risk practitioner's NEXT step?

Developing a mechanism for monitoring residual risk is an important part of the implementation and ongoing management of risk responses, but it comes after the decision to approve and fund specific responses.

Updating the risk register is a record-keeping activity that should happen throughout the process, including after decisions are made. However, it's not the next step in the decision-making process after identifying options; the next step is to get approval for those options.

Once risk owners and potential response options are identified, it's essential to evaluate these options. Preparing a business case involves analyzing the costs, benefits, and overall feasibility of each proposed risk response. This step provides senior management with the necessary information to make an informed decision on which response options to approve and fund, ensuring resources are allocated effectively and strategically.

Identifying resources for implementing responses comes after the response options have been approved through a decision-making process, which the business case facilitates.