An organization plans to implement a new AI system. Which of the following is the MOST important factor in determining the level of risk monitoring activities required?

Question

Options

• AThe organization's risk appetite
• BThe organization's number of AI system users
• CThe organization's risk tolerance
• DThe organization's compensating controls

• A
  7% (3)
• B
  2% (1)
• C
  88% (38)
• D
  2% (1)

Explanation

Risk tolerance defines the specific, quantifiable boundaries of acceptable variation in outcomes - it is the operational threshold that directly determines when monitoring must escalate or trigger action. While risk appetite (A) expresses the overall willingness to accept risk at a strategic level, it is too broad to set precise monitoring thresholds. Number of users (B) may affect exposure but does not by itself define monitoring intensity. Compensating controls (D) are responses to identified risk, not the factor that calibrates how much monitoring is needed. Risk tolerance (C) is the precise, measurable limit that drives the design and intensity of risk monitoring activities.

No community discussion yet for this question.