Utility function is a term used to describes a person’s or organization’s willingness to accept risk. The lower the utility function the more risk response planning is needed. 2 is incorrect; risk exposure is based on each project. 3 is incorrect because mitigation is one response to a risk event. 4 is incorrect because risk probability describes the likelihood of a risk event actually happening.