What is a risk analysis used for?

A.
A risk analysis is used to express the value of information for an organization in monetary terms.

B.
A risk analysis is used to clarify to management their responsibilities.

C.
A risk analysis is used in conjunction with security measures to reduce risks to an acceptable level.

D.
A risk analysis is used to ensure that security measures are deployed in a cost-effective and timely fashion.

Explanation:
The purpose of carrying out a risk analysis is to clarify which threats are relevant to the operational processes and to identify the associated risks. The appropriate security level, along with the associated security measures, can then be determined.
A risk analysis is used to ensure that the security measures are deployed in a cost-effective and timely manner, and consequently provide an effective answer to the threats.

The purpose of risk management (not risk analysis) is to reduce risks to an acceptable level.