Free Access Isaca CRISC New Release

 Business process owners are the most important to include in the assessment of existing IT risk scenarios, as they have the authority and responsibility to manage the business processes and their associated risks and controls, and to provide the business perspective and requirements for the IT risk scenarios. Technology subject matter experts, business users of IT systems, and risk management consultants are not the most important to include, as they may have different roles and responsibilities related to the technical, operational, or advisory aspects of IT risk scenarios, respectively, but they do not own the business processes or the IT risk scenarios. References = CRISC Review Manual, 7th Edition, page 101.

The primary focus of an ongoing risk awareness program should be to enable better risk-based decisions, as this can help the organization to achieve its objectives, optimize its performance, and manage its risks effectively. An ongoing risk awareness program is a process of educating, communicating, and engaging the stakeholders about the organization’s risk management framework, methodology, and practices. An ongoing risk awareness program can help the stakeholders to understand the risk context, criteria, appetite, and profile of the organization, and to identify, assess, treat, monitor, and review the risks that may affect their roles and responsibilities. By doing so, an ongoing risk awareness program can empower the stakeholders to make informed and rational decisions that balance the benefits and costs of risk-taking, and that align with the organization’s strategy and goals.

References:

•ISACA, Risk IT Framework, 2nd Edition, 2019, p. 761

•ISACA, Managing Human Risk Requires More Than Just Awareness Training2

The most important factor for management to consider when deciding whether to invest in an IT initiative that exceeds management’s risk appetite is C. Risk tolerance1

According to the CRISC Review Manual, risk tolerance is the acceptable level of variation that management is willing to allow for any specific risk as the enterprise pursues its objectives. Risk tolerance reflects the degree of uncertainty that an organization is prepared to accept in relation to achieving its goals2

When an IT initiative exceeds management’s risk appetite, it means that the potential benefits of the initiative are outweighed by the potential negative consequences or losses that could result from the initiative. However, management may still decide to invest in the initiative if the level of uncertainty or variation is within the organization’s risk tolerance. For example, management may accept a higher level of risk for a strategic or innovative initiative that could provide a competitive advantage or a significant return on investment3