Risk management can be represented as a four step process. The four steps, shown randomly, are:

1. Establish appropriate risk management policies.

2. Risks are identified by key stakeholders.

3. Risks are monitored on an ongoing basis.

4. Risks are evaluated according to the likelihood of occurrence and impact on the organization.

Which of the following is the correct order for the four steps?