We have noted the similarity between good management thinking and good Risk Management thinking. We have seen how this applies to two phases in the management process: establishing desirability and feasibility, or identifying the risk and considering the controls.
The third element in the process is: Viability. This is where we ask whether the solution is affordable and practicable, given constraints such as time and cost. Considering who is going to do it is also worthwhile if it is actually going to happen.
This is similar to evaluating the controls and balancing the cost and other effects of any new controls against the size and probability of the risk.
You may think these three phases are all there are. I will explain in my next blog why there have to be two more.