CISM Question 243

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  Risk tolerance may be defined using IT process metrics or adherence to defined IT procedures and policies, which are a translation of the IT goals that need to be achieved. Like risk apppetite, risk tolerance is defined at the enterprise level and reflected in the policies created by senior management. Exceptions can be tolerated at lower levels of the enterprise as long] fs the overall exposure does not exceed the risk appetite at the enterprise level.]

• 2

  If the exception is to be approved by senior management, clearly it does NOT fall under the organization's risk appetite. I answer A

• Chose C4

  C. Exceptions reflect the organizational risk appetite. While all of the options are important in the context of information security, ensuring that exceptions align with the organization's risk appetite is crucial. This means that exceptions should be evaluated and granted or denied in a way that takes into account the organization's tolerance for risk. If an exception introduces too much risk or deviates significantly from the established risk tolerance, it could jeopardize the overall security of the organization. Therefore, aligning exceptions with the organization's risk appetite is a fundamental consideration in the exception management process.