Project risk factor is considered in

Concept: Software process (SDLC) models differ mainly in which activity governs how a project moves from one stage to the next. A model is called risk-driven when identifying and mitigating project risk is built in as a formal, repeated step of its own, not just an implicit side effect of planning, prototyping, or incremental delivery.

Application: The Spiral Model (Barry Boehm) structures every cycle around four repeated quadrants:

1. Determine objectives, alternatives, and constraints for that cycle.

2. Evaluate alternatives; identify and analyse project risks, then plan risk-mitigation steps.

3. Develop and verify the next-level product (the engineering work for that cycle).

4. Review progress and plan the next cycle.

Because risk identification and mitigation form the second quadrant of every single loop through the spiral, project risk is a structural, mandatory part of the model, which is exactly what the question is asking about.

Cross-check: how the other models compare, by their own defining trait.

• Waterfall model: phases (requirements, design, implementation, testing, maintenance) each run once, in strict sequence; there is no built-in loop to revisit risk as the project proceeds.

• Prototyping model: iterates on early, working prototypes to pin down unclear user requirements; the driver is requirement clarity, not risk assessment.

• Iterative enhancement model: delivers the system as a sequence of functional increments, each adding capability to the previous build; the driver is incremental scope delivery, not a formal risk-analysis step.

• Spiral model: repeats a dedicated risk-analysis quadrant in every cycle, which is the property the question is testing.

Result: only the spiral model has risk analysis designed in as a repeated phase, so the correct choice is the spiral model.