An entity's risk assessment process:

is the entity's process for identifying and responding to business risks and the results of those risks.

never allows management of an entity to decide to accept a risk without taking any action.

is designed to help an entity think about risk in the same way that an auditor thinks about risk.

is established only if the entity is subject to unusually high risk.