correct to my previous comment :
let's say legislative change came in guidelines of senitive data storage, but our buiness may not deals with that sensitive data at all . so we are not going to be affected by the change right , so we do rik assessment oly when changes effect us(operations) hence correct answer is A
same question was there in another exam also , hence got confused a little

Since the plan is already in progress, the management action would be to check whether legislative change can impact the current operation, that would be done by risk assessment ,since Risk assessments recognize all of the risks that have the potential to impact the organization’s operations
There Is no need to update it strategic plan directly, as output of risk assessment, update in IT strategy may be required but it’s not necessary to directly assess and update IT strategy plan.
Since legislative change would affect IT operation and risk assessment assess impact on operation hence risk assessment should be done
https://advisera.com/27001academy/knowledgebase/risk-assessment-vs-business-impact-analysis/
https://ipspecialist.net/risk-assessment-vs-business-impact-analysis/
https://itgovernance.co.uk/blog/whats-the-difference-between-a-risk-assessment-and-a-business-impact-analysis