Risk management is the continuous and proactive process of identifying areas where a business may suffer losses, assessing the likelihood and potential impact of those losses, and implementing security countermeasures to minimize or eliminate them. This function ensures that organizational assets-people, property, and information-are protected against threats such as theft, sabotage, natural disasters, and operational failures.
References from PSP: ASIS POA - Risk Management; PSP Study Guide - Physical Security Assessment Domain

Observability refers to how easily an adversary can detect or notice a weakness in a system, process, or environment. In risk management and security concepts often applied within Human Resource and organizational safety frameworks, observability is directly linked to the visibility of vulnerabilities. If a vulnerability is highly observable, it means that it can be easily recognized by an external or internal threat actor. This recognition increases the likelihood that the weakness may later be exploited. However, observability itself does not involve exploiting or causing the vulnerability, but rather identifying its presence.
HR policies and workplace controls aim to reduce observability by implementing safeguards, training, and awareness programs to ensure that sensitive weaknesses are not easily detected by unauthorized individuals.

Case law is the result of judicial decisions and precedents established through court interpretations of existing laws, whether based on common law (historical precedents from English law) or statutory law (laws passed by legislatures). It forms part of the legal framework in many jurisdictions and evolves through court rulings.
Criminal law (A) defines offenses and penalties.
Constitution law (D) governs foundational legal principles.
Offended suit (B) is not a recognized legal term.
References:
ASIS POA Manual - Legal Foundations in Security
PSP Study Guide - Legal Concepts and Regulatory Requirements

Comprehensive Detailed Explanation:
The "Theft Triangle" is a concept used in physical security and loss prevention to illustrate the three primary elements that must exist for theft to occur: motive, desire, and opportunity.
Motive: The reason someone considers committing theft (e.g., financial hardship).
Desire: The internal emotional or psychological urge to obtain something.
Opportunity: The circumstances or vulnerabilities that allow the act to occur.
All three must typically be present for theft to happen. This model is used in behavioral risk assessments and insider threat prevention strategies.
References:
ASIS POA Manual - Chapter: Personnel and Insider Threats
PSP Study Guide - Insider Threat Models

The three most common categories of risk in organizational security are:
Personnel: Risks to human safety and behavior.
Property: Risks to physical and digital assets.
Liability: Legal exposure due to negligence or failure to act.
This classification helps align mitigation strategies and insurance planning.
A and D incorrectly list "hazards" as a category rather than a risk source.
B omits personnel, a critical category.
References:
PSP Study Guide - Types of Risk
POA Manual - Risk Classification and Management