CGEIT: Certified in the Governance of Enterprise IT

By Isaca · Question Mode

QuestionQ4

VerifiedRisk Optimization

An IT governance committee is establishing a risk management policy for a portfolio of IT-enabled investments. Which of the following is the PRIMARY consideration when developing the policy?

Explanation

Enterprise risk appetite is the primary basis for a risk management policy because it defines the level and types of risk the organization is prepared to accept while pursuing its objectives. The policy, framework selection, controls, and investment risk decisions should align to that boundary.

Community Discussion

No comments yet. Be the first to start the discussion!