Explanation : Risk monitoring, mitigation, and management require recognizing and
taking action when these (risk exposure and risk tolerance) are not in line.
Risk governance involves setting the risk tolerance. Risk identification and
measurement involves identifying and measuring the risk exposures.