Risk management comprises two core activities: identification (recognizing potential risks) and response development (creating strategies to address them). Response strategies include mitigation, transfer, avoidance, or acceptance based on risk analysis and organizational priorities.