CISM Question 167

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  Risk appetite tells you IF you need to remediate (i.e., "Is this risk acceptable?"). However, once you have a list of 10 risks that are all "unacceptable," you need the Evaluation (Choice A) to tell you which of those 10 to fix first.

• 3

  The evaluation of risks includes the comparison of risks to the organizations risk appetite. A is correct.

• Chose C5

  C. Comparison to risk appetite The most important consideration when prioritizing risk remediation should be the comparison to the organization's risk appetite. An organization's risk appetite is the amount of risk it is willing to accept in pursuit of its objectives. Prioritizing remediation efforts based on how identified risks align with the organization's risk appetite ensures that resources are focused on mitigating risks that surpass the acceptable level of risk the organization has established. While the evaluation of risk (A), duration of exposure (B), and impact of compliance (D) are all important factors to consider, they should all be considered within the context of the organization's risk appetite.