Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
D. Changes in residual risk after implementing the plans. Management's primary consideration when approving risk response action plans should be "D. Changes in residual risk after implementing the plans." Residual risk is the risk that remains after controls and mitigation efforts have been applied. Evaluating how the proposed action plans impact the residual risk provides a clear understanding of how effective the plans will be in reducing the organization's overall risk exposure. While the other options (prioritization for implementing the action plans, ability to address multiple risk scenarios, ease of implementation) are important factors to consider, they are secondary to understanding how the proposed plans will impact the organization's risk profile and whether they will result in a desirable reduction of risk exposure.
Senior management ultimate goal to decrease the residual risk. They are expecting this even they approve the action plan before seeing the results!
going for D: Primary focus is my view is that the plan will reduce the risk prioritization comes after. what is the point of prioritizing of the action plan does not lower residual risk?