An entity’s risk assessment process: 

(a) Is the entity’s process for identifying and responding to business risks and the results thereof. 

(b) Is established only if the entity is subject to unusually high risk. 

(c) Is designed to help an entity think about risk in the same way that an auditor thinks about risk. 

(d) Never allows management of an entity to decide to accept a risk without taking any action.