Which of the following is NOT typically a phase in the DSAC Annex F risk management process?

• A. Disaster recovery planning
• B. Monitoring and review
• C. Communication
• D. Risk assessment

Answer: (C)

DSAC Annex F risk management follows a lifecycle that centers on identifying and evaluating risks, planning appropriate responses, implementing controls, and then checking how well those controls perform. Disaster recovery planning fits into the risk treatment and continuity side of things: it outlines how to restore critical operations after a disruption. Monitoring and review is its own phase, dedicated to tracking risk posture, updating plans, and ensuring controls stay effective over time. Risk assessment is the essential starting point, revealing what risks exist and how serious they could be.

Communication, while vital throughout the process, isn’t treated as a separate phase in Annex F. It runs across all activities to keep stakeholders informed, decisions aligned, and actions coordinated. Because it’s an ongoing enabler rather than a distinct stage, it’s not typically listed as a standalone phase in the DSAC Annex F risk management process.