Which of the following is the BEST outcome measure to determine the effectiveness of IT risk management processes?

The frequency of updates to the risk register is a process metric, not an outcome measure reflecting actual risk reduction or impact.

The time lag between identification and response is a process efficiency metric, not a direct measure of the impact on the business.

The ultimate goal of IT risk management is to minimize disruptions and negative impacts on business processes. Therefore, measuring the number of actual events that negatively affect business operations due to ineffective or delayed risk responses directly reflects the success or failure of the risk management processes in preventing adverse outcomes.

Business user satisfaction with risk training is an input or awareness metric, not a direct outcome measure of the effectiveness of risk management in protecting the business.