In IO operations, what is the role of risk assessment in the planning cycle?

• A. It determines which audiences to target
• B. It has no role
• C. It only concerns the cybersecurity team
• D. It informs objective setting and measures

Answer: (D)

In IO operations, risk assessment is how planners connect potential threats to what they want to achieve and how they’ll know if they’re succeeding. By identifying likely hazards and their potential impacts, it helps shape the objectives you set so they explicitly address those risks and include safeguards or mitigations. It also defines the measures you’ll use to track progress, such as indicators of risk levels, thresholds that trigger a plan adjustment, and the level of residual risk you’re willing to accept after mitigations. Because of this, risk assessment is embedded in the planning cycle from the start, guiding priorities, resource allocation, timelines, and how success is evaluated. It’s not just about audiences or a single team—audience decisions and cybersecurity concerns are parts of a broader risk picture, and saying it has no role would miss how risks influence what you aim to achieve and how you measure it.