Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Level 2 based on the process of elimination. Nothing else fits.
B Level 2 In Risk Management Capability Maturity Models, Level 2 (Repeatable) is where risk appetite and tolerance are applied only during episodic (occasional) risk assessments rather than being integrated into ongoing decision-making processes. Level 1 (Ad hoc): Risk management is informal and reactive. Level 2 (Repeatable): Risk processes exist but are not consistently applied; risk appetite is considered only during specific risk assessments. Level 3 (Defined): Risk management is formalized and embedded into processes. Level 4 (Managed): Risk appetite and tolerance are actively managed and integrated into decision-making. At Level 2, organizations still lack a fully mature risk culture, applying risk appetite and tolerance in isolated events rather than continuously.