Watch this video on YouTube
What is the difference between risk assessment and risk management in the context of information security?