CRISC Question 324

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C2

  Going with "C". These questions are confusing; the board of directors defines the risk appetite; the question assumes that the CRO or risk practitioner ( or otherwise who is responsible to initiate the risk management program) to communicate the risk appetite to senior management. Does not the senior management know previously the risk appetite from the BOD ?

• 1

  going for C because: The desired risk level is the level of risk that the organization is willing to accept, given its risk appetite and tolerance. It represents the balance between the organization's strategic objectives and the potential risks that it faces. It is important to communicate the desired risk level to senior management because it sets the tone for the risk management program and provides guidance on the types of risks that should be prioritized and the appropriate risk response strategies.

• Chose C1

  If we go with the Board defines the risk appetite, then C makes sense.