The effective management of risk requires specific types of action. Which of the following pairs of actions would be BEST to manage risk?

Training staff raises awareness but identification alone, without the subsequent analysis and management of exposure, does not constitute a complete or effective risk management process.

Risk management best practice follows a structured lifecycle: identification surfaces risks that could affect services or business objectives; analysis evaluates the probability and potential severity of each risk; and managing exposure applies responses such as mitigation, transfer, avoidance, or acceptance to reduce risk to an acceptable level. Together, these three actions address risk from discovery through active control and align with recognized frameworks such as M_o_R and ISO 31000. Omitting any one element leaves the organization without either the knowledge of what risks exist or the means to control them.

Controlling exposure is only one phase of the process, and capital investment is a financial response that is not universally applicable as a risk management action.

Staff training and capital investment are supporting activities and do not form a structured, repeatable risk management process on their own.