Which one of the following is not considered to be a component of a standard risk framework?

Question $22$ options:

risk analysis

root cause analysis

threat analysis

vulnerability assessment

Inherent risk classification $($asset value$)$