nerdexam
Isaca

CGEIT · Question #364

The MAIN responsibility of the board of directors regarding the management of enterprise risk is to:

The correct answer is A. ensure a risk process exists which addresses the risk appetite. The main responsibility of the board of directors regarding enterprise risk management is to ensure a robust risk process exists that addresses the organization's risk appetite.

Submitted by packet_pusher· Apr 18, 2026Governance of Enterprise IT

Question

The MAIN responsibility of the board of directors regarding the management of enterprise risk is to:

Options

  • Aensure a risk process exists which addresses the risk appetite.
  • Bsustain investment in staff training regarding IT risk.
  • Cpromote a benefits-driven culture throughout the enterprise.
  • Dmaintain awareness of IT risk to the business.

How the community answered

(25 responses)
  • A
    88% (22)
  • C
    8% (2)
  • D
    4% (1)

Why each option

The main responsibility of the board of directors regarding enterprise risk management is to ensure a robust risk process exists that addresses the organization's risk appetite.

Aensure a risk process exists which addresses the risk appetite.Correct

The board of directors is ultimately responsible for the overall governance of the enterprise, which includes ensuring that an effective risk management framework and processes are established. This oversight involves confirming that the organization's risk appetite is defined and that the risk management process operates to identify, assess, respond to, and monitor risks in alignment with that appetite, protecting stakeholder value.

Bsustain investment in staff training regarding IT risk.

Sustaining investment in staff training regarding IT risk is an operational responsibility, typically delegated to management, not the primary oversight role of the board.

Cpromote a benefits-driven culture throughout the enterprise.

Promoting a benefits-driven culture is a broad strategic objective, but not the specific main responsibility related to the management of enterprise risk.

Dmaintain awareness of IT risk to the business.

While maintaining awareness is part of their role, the board's main responsibility is to ensure the process exists and is effective in addressing risk appetite, not just to be aware of risks.

Concept tested: Board of directors' risk oversight

Source: https://learn.microsoft.com/en-us/compliance/regulatory/audits-risk-assessment-board-management-oversight

Topics

#Board of Directors#Enterprise Risk Management#Risk Appetite#IT Governance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGEIT Practice