Explanation

• Option A (Incorrect): Risk management is not about predicting the exact timing of crises. While risk managers aim to minimize surprises, they cannot foresee specific events, such as a real estate crisis causing defaults on securities.

• Option B (Correct): A sound risk management process involves governance-level discussions to assess the balance between expected returns and potential losses, determining whether such risks are acceptable.

• Option C (Incorrect): Ignoring low-probability but high-impact events is a flaw in risk management. A comprehensive process should account for all potential risks, regardless of their likelihood.