Which one of the following would be expected to form the main part of a...

Deciding on the approach to project risk management.

Evaluating the risk in terms of severity and relative importance.

Deciding on how to respond to the risk and who should implement the response.

Deciding if the risk is a threat or opportunity.