What should a risk assessment produce as its result?

• A. A rough memo
• B. A formal, documented analysis of risk
• C. A physical audit
• D. A test plan

Answer: (B)

A risk assessment should produce a formal, documented analysis of risk. This means a structured report that clearly identifies threats to cardholder data, the vulnerabilities that could be exploited, and assigns likelihood and impact to each risk. The result should rank risks and include recommended mitigations or treatment options, so stakeholders can decide what controls to implement and in what order. This formal document provides the basis for resource allocation, risk acceptance, and tracking residual risk over time, and it can be reviewed by auditors or regulators.

Rough memos are too vague to support consistent decision-making, and a physical audit focuses on verifying controls already in place rather than listing identified risks. A test plan guides how controls are tested, not the outcomes of risk evaluation. The formal, documented risk analysis is the appropriate deliverable because it documents the risk landscape and informs remediation and ongoing risk management.