CISA: Certified Information Systems Auditor

Information security policies must align with the organization’s information security risk appetite so that required controls and risk-treatment decisions reflect the level and types of risk the organization is willing to accept. Misalignment can leave material risks insufficiently addressed or impose controls inconsistent with approved risk tolerance.