Risk Management

In your opinion is there a difference between risk assessment and risk analysis?

What are the major differences between audit and risk management?

In my own words audit is the process that compares current controls against 
governance or best practice to find areas that don't rise to standard and then 
recommend controls to address shortcomings. 

Risk management would be the process of assessing risk, deciding controls, 
implementing controls, and assessing effectiveness.  

In what category would you put Vulnerability Assessment / Penetration Testing?  
I would categorize it as part of audit but I may be wrong.

I need to clearly differentiate the two processes to management.  So any 
additions or subtractions would help me understand. 


Thanks,

Lee