ISC2 CSSLP Exam - Topic 3 Question 54 Discussion

The risk management plan defines the roles and responsibilities for conducting risk management.

A Risk management plan is a document arranged by a project manager to estimate the effectiveness, predict risks, and build response plans

to mitigate them. It also consists of the risk assessment matrix.

Risks are built in with any project, and project managers evaluate risks repeatedly and build plans to address them. The risk management

plan consists of analysis of possible risks with both high and low impacts, and the mitigation strategies to facilitate the project and avoid

being derailed through which the common problems arise. Risk management plans should be timely reviewed by the project team in order to

avoid having the analysis become stale and not reflective of actual potential project risks. Most critically, risk management plans include a risk

strategy for project execution.

Answer A is incorrect. The risk register does not define the risk management roles and responsibilities.

Answer D is incorrect. Enterprise environmental factors may define the roles that risk management officials or departments play in the

project, but the best answer for all projects is the risk management plan.

Answer B is incorrect. The staffing management plan does not define the risk management roles and responsibilities.