Which of the following is not part of the definition of risk?

Which of the following is not part of the definition of risk?

A.
An impact on assets based on threats and vulnerabilities

B.
Controls addressing the threats

C.
Threats to and vulnerabilities of processes and/or assets

D.
Probabilities of the threats

Explanation:
Threats, impact, and probabilities are all elements of risk. Controls
are developed to address the risk and are not an element of risk in them.