Analysis of Options:
* A. The organisation must attempt to identify and address every risk it faces:Incorrect. ISO 45001 focuses on OH&S risks and not every risk faced by the organization.
* B. The effect of uncertainty (i.e. risk) can result in positive outcomes as well as negative ones:
Correct. Clause 3.20 defines risk as the "effect of uncertainty," which may result in positive or negative outcomes.
* C. Although organisations are required to carry out risk management, the method by which they do so is up to them:Correct. ISO 45001 does not prescribe specific risk management methods, leaving the organization to choose the approach that best suits its context (Clause 6.1.2).
* D. Risk assessment is an activity that must be carried out by top management:Incorrect. Risk assessment can involve workers and other personnel; it is not limited to top management.
* E. The organisation is required to assess risks arising from OH&S hazards:Correct. Clause 6.1.2.2 requires organizations to assess OH&S risks associated with hazards.
* F. Risk is often expressed as a combination of likelihood and impact:Correct. This is a common way to express risk, aligned with Clause 6.1.2.
ISO References:
* Clause 3.20: Definition of risk.
* Clause 6.1.2: Hazard identification and risk assessment