Who is accountable for establishing the privacy risk and harm tolerance levels?

Question

Options

• AChief privacy officer
• BEnterprise risk management committee
• CPrivacy steering committee
• DChief risk officer

• A
  6% (3)
• B
  90% (43)
• C
  2% (1)
• D
  2% (1)

Explanation

Enterprise risk management (ERM) committees are accountable for setting privacy risk and harm tolerance levels because tolerance thresholds are an organizational risk governance decision - they define how much risk the entire enterprise is willing to accept, which falls squarely within ERM's mandate to set and oversee risk appetite across all domains.

• A (Chief Privacy Officer): The CPO implements and operationalizes privacy programs but does not set the organization's overall risk tolerance - that's a governance-level, not an operational-level, responsibility.
• C (Privacy Steering Committee): This group typically advises on privacy strategy and coordinates cross-functional efforts, but it reports into enterprise risk governance rather than setting tolerance levels itself.
• D (Chief Risk Officer): The CRO often chairs or supports the ERM committee but acts as an individual executive, not the accountable body. Risk tolerance is a collective governance decision, not a single officer's call.

Memory tip: Think "tolerance = appetite = enterprise-wide policy." Whenever an exam question asks who sets risk appetite or tolerance at the highest level, look for the committee or board answer over any individual role - enterprise risk decisions require collective authority, not a single title.

No community discussion yet for this question.