nerdexam
Isaca

CGEIT · Question #103

An enterprise has been focused on establish ng an IT risk management framework. Which of the following should be the PRIMARY motivation behind this objective?

The correct answer is A. Promoting responsibility throughout the enterprise for managing IT risk. The primary motivation for an IT risk management framework is to promote and embed responsibility for managing IT risk throughout the entire enterprise.

Submitted by klara.se· Apr 18, 2026Governance of Enterprise IT

Question

An enterprise has been focused on establish ng an IT risk management framework. Which of the following should be the PRIMARY motivation behind this objective?

Options

  • APromoting responsibility throughout the enterprise for managing IT risk.
  • BIncreasing the enterprise's risk tolerance level and risk appetite.
  • CEngaging executives in examining IT risk when developing policies.
  • DMaintaining a complete and accurate risk registry to belief manage IT risk

How the community answered

(56 responses)
  • A
    91% (51)
  • B
    2% (1)
  • C
    5% (3)
  • D
    2% (1)

Why each option

The primary motivation for an IT risk management framework is to promote and embed responsibility for managing IT risk throughout the entire enterprise.

APromoting responsibility throughout the enterprise for managing IT risk.Correct

A robust IT risk management framework aims to foster a culture where risk management is a shared responsibility across all levels and departments. This ensures that all employees understand their role in identifying, assessing, and mitigating IT risks, thereby protecting the enterprise as a whole and making risk management an integral part of operations.

BIncreasing the enterprise's risk tolerance level and risk appetite.

An IT risk management framework is designed to manage and mitigate risks, and while it might inform risk tolerance, its primary purpose is not to simply increase the enterprise's risk tolerance or appetite.

CEngaging executives in examining IT risk when developing policies.

Engaging executives in examining IT risk when developing policies is a crucial component and output of a risk management framework, but not the overarching primary motivation for establishing the framework itself.

DMaintaining a complete and accurate risk registry to belief manage IT risk

Maintaining a complete and accurate risk registry is an important operational tool and output of a risk management framework, serving to document and track risks, but it is not the fundamental primary motivation for its establishment.

Concept tested: IT risk management framework objectives

Source: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-risk-mitigation

Topics

#IT risk management framework#Enterprise risk management#Risk governance#Accountability

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGEIT Practice