Which of the following is a strategy for managing risk?

Retention is a strategy for managing risk that involves accepting the risk and deciding to deal with the consequences rather than avoiding or transferring the risk to another party. This approach is often taken when the potential negative outcomes of a risk are deemed to be manageable or when the costs of other strategies, such as avoidance or mitigation, may outweigh the benefits. By retaining a risk, an organization acknowledges the risk exists but chooses to take no action to change its exposure or to address it actively. This can be appropriate in situations where the risk is minor or where the organization has the resources to absorb potential losses.

In contrast, other options like inaction and neglect suggest a failure to respond to risks appropriately, which could lead to adverse outcomes. Identification is crucial, as it involves recognizing risks, but alone it does not constitute a management strategy.