The first step in creating an effective risk$-$management system is to understand the qualitative distinctions among the types of risks that organizations face.

Kaplan and Mikes identify three categories of risk. Which category cannot be managed through a rules$-$based control model. Instead, you need a risk$-$management system designed to reduce the probability that the assumed risks actually materialize and to improve the company's ability to manage or contain the risk events should they occur.

$$ Category $1$: Preventable Risks

Category $2$: Strategic Risks

Category $3$: External Risks

None of the above