The CIO in a large enterprise is seeking assurance that significant IT risk is being proactively monitored and does not exceed agreed risk tolerance levels. The BEST way to provide this ongoing assurance is to require the development of:
Correct Answer: C
According to the CGEIT certification guide, key risk indicators (KRIs) are the best way to provide ongoing assurance that significant IT risk is being proactively monitored and does not exceed agreed risk tolerance levels. KRIs are metrics that measure the likelihood or impact of potential or actual risks, and provide early warning signals of increasing risk exposures1. KRIs can help IT management to track and report the status and trends of IT risks, and to trigger timely responses and actions when the risk levels approach or exceed the predefined thresholds2. The other options are less suitable than option C, as they do not provide ongoing assurance or proactive monitoring of IT risk. An IT risk appetite statement is a document that expresses the amount and type of risk that an organization is willing to take in order to meet their strategic objectives3. A risk management policy is a document that defines the principles, framework, and processes for managing risks in an organization. A risk register is a tool that records and tracks the identified risks, their causes, impacts, likelihood, responses, and owners.
References :=
* CGEIT certification guide, domain 3: Risk Optimization, section 3.4: Risk Monitoring and Assurance, page 98.
* Key Risk Indicators (KRIs) - Definition from KWHS
* Risk Appetite - an overview | ScienceDirect Topics
* Risk Management Policy - an overview | ScienceDirect Topics
* Risk Register - an overview | ScienceDirect Topics