CGEIT: Certified in the Governance of Enterprise ITDemo

By Isaca · Question Mode

QuestionQ3

Risk Optimization

An enterprise chooses to accept the IT risk of a subsidiary in another country, although the risk exceeds the enterprise’s risk appetite. Which of the following is the BEST justification for this decision?

  • A Local market common practices
  • B Risk framework alignment
  • C Technical gaps among subsidiaries
  • D Compliance with local regulations
Explanation

Compliance with applicable local regulations can require operating conditions or constrain available risk treatments. Such a legal obligation is a stronger basis for a formally governed exception to the enterprise’s normal risk appetite than local practices, framework alignment, or technical differences. ISACA identifies laws and regulations as externally imposed requirements and distinguishes them from controls used to manage risk within appetite and tolerance.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!