CGEIT: Certified in the Governance of Enterprise IT

The number of events that affect business processes because responses to risks were delayed is a direct business-impact outcome. It indicates whether risk management is preventing or limiting realized risk; response time, satisfaction with training, and register-update frequency primarily measure process activity or perception. ISACA describes risk management as managing risk within the enterprise’s risk appetite and emphasizes assessing risks by their likelihood and business impact.