How does risk assessment contribute to continual improvement?

• A.Regular risk reassessment identifies new risks and evaluates treatment effectiveness, driving improvements in the ISMS
• B.Risk assessment identifies problems for the risk register and stops there, with improvement decisions taken separately by the internal audit function at year end
• C.Risk assessment is performed once at ISMS establishment, and the resulting treatment plan is carried unchanged through each certification cycle
• D.Risk assessment sits outside the improvement cycle, and reports to the risk committee alone