The CIO in a large enterprise is seeking assurance that significant IT risk is being proactively monitored and does not exceed agreed risk tolerance levels. The BEST way to provide this ongoing…

An IT risk appetite statement defines the level of risk an organization is willing to accept but does not provide ongoing monitoring or assurance of current risk levels.

A risk management policy establishes the rules and procedures for managing risk but does not offer direct, continuous monitoring of actual risk levels.

Key Risk Indicators (KRIs) are metrics used to provide an early warning of increasing risk exposure in a specific area, enabling proactive monitoring and management to ensure risks do not exceed agreed tolerance levels.

A risk register is a list of identified risks, their assessments, and mitigation plans, but it is a static record and does not inherently provide proactive, real-time monitoring of risk levels and tolerance adherence.