ISACA Certified in the Governance of Enterprise IT Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  An enterprise may accept IT risk that exceeds its usual risk appetite if compliance with local regulations necessitates it. Legal and regulatory requirements often override internal risk policies, as failure to comply could result in legal penalties, financial loss, or operational restrictions. Technical gap disparities should be mitigated rather than accepted as a justification for increased risk. The answer is D.

• Chose C1

  I think its C. The enterprise is the one accepting the risk, justification would be like the subsidiary had less technical baselines and so the enterprise couldn't anything about it. I wouldn't choose D because the Standards are global

• Chose D1

  i think is D