CRISC: Certified in Risk and Information Systems Control

By Isaca · Question Mode

QuestionQ80

VerifiedRisk Response and Reporting

A key risk indicator (KRI) is periodically reported to senior management as exceeding its thresholds, yet senior management has decided each time not to take action to reduce the risk. Which of the following is the MOST likely reason for senior management’s response?

Explanation

A KRI threshold is intended to trigger management attention when risk exceeds the organization’s tolerated level. If senior management repeatedly accepts the exposure without mitigation, the threshold most likely does not reflect the organization’s actual risk appetite and should be revised accordingly.

Community Discussion

No comments yet. Be the first to start the discussion!