Which approach best describes a governance-aligned risk management process in MDC3?

• A. Identify, assess, mitigate, and monitor risks in a way that aligns with governance and project priorities.
• B. Ignore governance to move faster.
• C. Only perform risk assessment when a failure occurs.
• D. Mitigate risks without monitoring.

Answer: (A)

Governance-aligned risk management follows a complete risk cycle that stays in sync with how the organization governs and prioritizes projects. The best approach is to identify risks, assess their likelihood and impact, decide on mitigations, and then monitor the risk and the effectiveness of those mitigations over time. Aligning this cycle with governance means evaluating each risk against policies, risk appetite, escalation paths, and decision rights, so the actions taken are directly supportable by governance and project priorities. This alignment keeps effort focused on the most significant threats and provides clear accountability as conditions change, with feedback loops to adjust controls as needed.

Why the other options don’t fit: ignoring governance to move faster breaks alignment with policies and priorities, risking noncompliance and misallocated resources. Waiting to perform risk assessment only after a failure is discovered is reactive and leaves the project exposed to avoidable damage. Mitigating risks without monitoring means you can’t verify effectiveness or detect new or evolving risks, so controls may become outdated or insufficient.