Identity management is really just another form of risk management.

• A. True
• B. False
• C. Sometimes
• D. Not sure

Answer: (A)

Identity management is about controlling who can access resources, under what conditions, and what they are allowed to do. That focus directly reduces risk: it prevents unauthorized access, limits what trusted users can do (through least privilege and role-based access), and provides accountability through provisioning, deprovisioning, and ongoing access reviews. In a risk management framework, you identify access-related threats (like credential compromise), assess their potential impact, and implement controls to minimize them. Identity management supplies many of those controls—strong authentication, proper authorization, regular audits, and timely revocation when someone changes roles or leaves—so it’s a fundamental way to manage risk. While it’s not the only risk management activity, it is clearly a form of risk management because its purpose is to lessen the likelihood and impact of access-based threats.