An IT strategy committee wants to ensure that a risk program is successfully implemented throughout the enterprise. Which of the following would BEST support this goal?

A risk management framework provides structure and guidelines, but without senior management commitment, its implementation and adoption may lack enforcement and resources.

Mandatory risk awareness courses are important for staff education, but they are a tactic within a program, not the primary factor ensuring enterprise-wide successful implementation.

A risk recognition and reporting policy defines procedures, but its effectiveness and adherence depend heavily on senior management's commitment to support and enforce it.

Commitment from senior management is paramount for successfully implementing an enterprise-wide risk program because it provides the necessary authority, resources, and endorsement for the program. This commitment fosters a culture of risk awareness, ensures policies are enforced, and integrates risk management into strategic decision-making across all levels of the organization.