The effective implementation of a risk treatment plan is best indicated by managing residual risk within the organization's appetite and tolerance levels. Residual risk is the remaining risk after controls have been applied, and ensuring it is within acceptable levels demonstrates that the risk treatment plan is effective.
* Managing Residual Risk within Appetite and Tolerance (Answer B):
* Definition: Residual risk is the risk remaining after risk treatment measures have been implemented.
* Significance: Managing residual risk within the set appetite and tolerance levels shows that the implemented controls are effective and aligned with the organization's risk management objectives.
* Outcome: It ensures that the organization's risk exposure is kept within acceptable boundaries, thereby protecting its assets and operations.
* Comparison with Other Options:
* A. Inherent risk is managed within an acceptable level:
* Definition: Inherent risk is the risk before any controls are applied.
* Limitation: The focus should be on residual risk post-treatment.
* C. Risk treatments are aligned with industry peers:
* Purpose: While benchmarking is useful, it does not directly indicate the effectiveness of risk treatment.
* D. Key controls are identified and documented:
* Purpose: Identifying and documenting controls is necessary, but effectiveness is shown by managing residual risk.
References:
* ISACA CRISC Review Manual, Chapter 3, "Risk Response and Reporting", which highlights the importance of managing residual risk within the organization's appetite and tolerance.