Which of the following is the PRIMARY ongoing responsibility of the IT governance function related to risk?

Responding to and controlling individual IT risk events is an operational function, typically handled by IT management or security teams, not the strategic IT governance function.

Communicating the enterprise risk management plan is a task performed by various parties, but the primary ongoing responsibility of IT governance is the strategic alignment of IT risk.

IT governance's primary responsibility related to risk is to ensure that IT risk management strategies and activities are consistently aligned with the organization's overarching business risk appetite, providing strategic oversight rather than operational execution.

Verifying staff skills is an important management task, but it is not the primary ongoing responsibility of strategic IT governance concerning risk alignment.