Implementing the Risk Management Process
The sequence, and why it is not a straight line
Communication and consultation (ongoing); scope, context and criteria; risk assessment - identification, analysis, evaluation; risk treatment; monitoring and review; recording and reporting. Communication, consultation, monitoring and review, and recording and reporting run throughout; the core steps are iterative. A question that presents them as a strictly linear, one-pass flow is testing this.
Criteria come first
Clause 6.3 fixes objectives, external and internal parameters, risk criteria (how significance is judged, how likelihood and consequence are combined, thresholds for action), and monitoring and reporting requirements. Without criteria, risk evaluation cannot be performed - an organization that ranks risks against undefined significance has failed at scope, context and criteria, not at treatment.
Assessment and treatment
Identification finds sources, events, causes and consequences, including opportunities. Analysis determines nature, likelihood, consequence, complexity and uncertainty. Evaluation compares results with criteria to decide whether further action is needed; choosing among options is treatment, not evaluation. The 2018 treatment options are: avoid; take or increase risk to pursue an opportunity; remove the risk source; change the likelihood; change the consequences; share the risk; retain the risk. Legacy wording such as "transfer" or "reduce" should be treated cautiously. Treatment plans specify the responsible person, resources, performance measures and timing.
Rule of thumb
Work backwards from the question's decision: "should we act at all?" is evaluation against criteria; "which option and who owns it?" is treatment. If no criteria exist yet, nothing downstream can be valid.