The correct answer is A. To create and protect value. ISO 31000:2018 explicitly states that the purpose of risk management is the creation and protection of value. This principle is foundational and underpins all other aspects of the risk management framework and process. According to ISO 31000, risk management improves performance, encourages innovation, and supports the achievement of objectives by addressing uncertainty in a structured and informed manner.

ISO 31000 does not define risk management as a mechanism to eliminate all risks. On the contrary, it recognizes that risk-taking is often necessary to pursue opportunities and create value. Attempting to eliminate all risks would be impractical and could hinder innovation, strategic growth, and operational effectiveness. Therefore, option B is incorrect.

Similarly, while compliance with legal and regulatory requirements is an important consideration within risk management, ISO 31000 clearly emphasizes that compliance is not the sole purpose of risk management. Risk management applies to all types of objectives---strategic, operational, financial, reputational, environmental, and social---and goes beyond regulatory compliance alone. Hence, option C is incomplete and incorrect.

ISO 31000 also acknowledges that uncertainty is inherent in organizational activities and decision-making. Risk management does not aim to remove uncertainty, but rather to understand, assess, and manage it in a way that supports informed decisions. Therefore, option D is incorrect.

From a PECB ISO 31000 Lead Risk Manager perspective, understanding that the ultimate purpose of risk management is value creation and protection is essential. This principle ensures that risk management is integrated into governance, strategy, and operations, supporting sustainable success rather than acting as a purely defensive or compliance-driven function.