CRISC: Certified in Risk and Information Systems ControlDemo

Question

Who is the MOST appropriate owner of a newly identified IT risk?

A The manager responsible for IT operations that will support the risk mitigation efforts
B The individual with the most IT risk-related subject matter knowledge
C The individual with authority to commit organizational resources to mitigate the risk
D A project manager capable of prioritizing the risk remediation efforts

Explanation

The risk owner must have the authority and accountability to decide how the risk will be treated and to commit the organizational resources required for mitigation. Subject-matter experts, operations managers, and project managers can support the response, but they are not necessarily empowered to make the required resource and risk-treatment decisions.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1587

Community Discussion