The correct answer is C. Controlling risks involves ensuring that responses to negative risks minimize disruption to the project while responses to positive risks maximize beneficial impact. Risk control is not merely the identification or planning of risks; it is the ongoing activity of tracking risk exposure, monitoring risk response effectiveness, identifying new risks, reassessing existing risks, and ensuring that treatment actions remain suitable. Negative risks, or threats, should be managed so that their probability or impact is reduced, transferred, avoided, or otherwise controlled. Positive risks, or opportunities, should be managed so that their probability or beneficial impact is enhanced, exploited, shared, or accepted where appropriate. Option A refers more to risk categorization or analysis, where common causes can help prioritize treatment. Option B describes risk response planning, where options and actions are developed before implementation. Control focuses on whether those responses are working and whether the project remains within acceptable risk exposure. PMBOK similarly describes risk monitoring as tracking identified risks, identifying and analyzing new risks, and evaluating risk process effectiveness. The uploaded question set records this ISO 21502 risk-control item.

Reference topics: risk control, risk responses, threats, opportunities, disruption minimization, beneficial impact maximization.