$1\mathrm{.}3$ An internal auditor recommends the $1$mplementat$1$on of a risk management cycle to management. He recommends that management take the following steps

$$ Determine what could go wrong, and how and why it might happen

$$ Estimate the likelihood and consequences of the decision to implement risk management

$$ Identify various forms of risk mitigation, including controls

$$ Review the costs of risk mitigation

$$ Use the lessons learned as a guide for future situations

Which important step did the auditor omit in his recommendation to management?

A risk identification

B risk analysis

C evaluation and audit

D performance measurement