In Risk-Based Testing (RBT), risk identification is an ongoing process that occurs throughout the lifecycle. It is defined in the initial test strategy and continuously performed on an ad-hoc basis as new risks emerge. Distractors stating it occurs only once are incorrect.