CRISC: Certified in Risk and Information Systems Control

By Isaca · Question Mode

QuestionQ59

VerifiedGovernance

During an IT risk scenario review session, business executives ask why they have been assigned ownership of IT-related risk scenarios. They believe IT risk is technical by nature and therefore should be owned by IT. Which of the following is the BEST way for the risk practitioner to address these concerns?

Explanation

IT risk should be expressed in terms of its effect on business objectives and outcomes. This establishes that business executives own the resulting business risk, while IT provides technical expertise and manages relevant controls.

Community Discussion

No comments yet. Be the first to start the discussion!