CRISC Question 323

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  Risk appetite means nothing if our risk management is not aligned to business plans

• Chose D1

  D. Confirm the organization's risk appetite and tolerance. When evaluating enterprise IT risk management, the most important action is to "D. confirm the organization's risk appetite and tolerance." The effectiveness of IT risk management hinges on its alignment with the organization's overall risk appetite and tolerance levels. This step ensures that risk management efforts are aligned with the organization's strategic objectives and priorities. While the other options (creating new control processes, reviewing alignment with the investment plan, reporting identified risk scenarios to senior management) are all relevant aspects of IT risk management, they should be undertaken in light of the organization's risk appetite and tolerance to ensure that the risk management efforts are appropriate and aligned with the organization's risk management strategy.

• Chose D1

  Going with D though I believe that the question needs rewording