Which of the following is NOT a component of risk management?

In the context of risk management, ignoring past incidents is indeed not a component of the process. Effective risk management requires a thorough understanding of historical data and past incidents, as they provide valuable insights into potential risks and vulnerabilities. Learning from previous occurrences helps organizations to identify patterns, anticipate future risks, and implement strategies to prevent similar issues from arising again.

On the other hand, components like identifying risks, mitigating adverse outcomes, and evaluating current exposures are essential parts of the risk management process. Identifying risks involves recognizing and documenting potential hazards or challenges that could affect an organization. Mitigating adverse outcomes focuses on developing strategies and measures to minimize the impact of identified risks. Evaluating current exposures is about assessing the present state of vulnerabilities and ensuring that the organization is aware of and prepared for potential risks. Each of these components is critical in establishing a comprehensive risk management framework, whereas ignoring past incidents would leave an organization ill-prepared to handle future challenges.