Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
C. Determine if the impact is outside the risk appetite The risk practitioner's first course of action should be to evaluate whether the impact of the ineffective controls falls within the organization's risk appetite. The risk appetite is the amount of risk an organization is willing to accept in pursuit of its objectives. Understanding this will help the risk practitioner decide on the next steps, whether that be implementing compensating controls, reporting the issue, or seeking a formal acceptance of risk.
risk practitioner do not deploy controls.
Answer is A