When I consider the differences between risk evaluation and risk management, it helps to think of these as two separate activities performed by management that are used in the risk assessment process. Risk evaluation typically involves management performing the following: Defining service commitments and system requirements; Identifying risk factors to those objectives; Assigning risk levels to those risks.