Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate the risk arising from changes to an organization's SaaS vendor?

The correct answer is C. Risk appetite. Risk appetite is the foundational organizational decision that defines how much risk is acceptable. When risk appetite changes - becoming more conservative or more permissive - it directly drives the expansion or reduction of controls needed to bring residual risk within acceptab

Cloud Risk Management

Question

Options

ARisk exceptions policy
BContractual requirements
CRisk appetite
DBoard oversight

How the community answered

(41 responses)

A
7% (3)
B
2% (1)
C
88% (36)
D
2% (1)

Explanation

Risk appetite is the foundational organizational decision that defines how much risk is acceptable. When risk appetite changes - becoming more conservative or more permissive - it directly drives the expansion or reduction of controls needed to bring residual risk within acceptable bounds. For example, if an organization lowers its risk appetite regarding SaaS vendor risk, more compensating controls must be deployed; raising it may allow relaxing controls. Risk exceptions policy (A) addresses individual deviations, contractual requirements (B) establish baseline obligations but don't dynamically drive control scope, and board oversight (D) is a governance mechanism rather than a direct control driver.

Topics

#Risk appetite#Control remediation#SaaS risk#Risk management

Community Discussion

No community discussion yet for this question.

Full CCAK Practice