Business management is seeking assurance from the CIO that controls are in place to help minimize the risk of critical IT systems being unavailable during month-end financial processing. What is the…

A communication plan is important for risk management but doesn't in itself assure business management that controls are in place or that risks are being actively minimized.

Outsourcing infrastructure hosting transfers some operational responsibilities but does not inherently guarantee system availability or address the specific concern about control visibility without further measures.

Restricting and monitoring user access primarily addresses security and data integrity risks, not directly the comprehensive risk of critical system *unavailability*.

Developing Key Risk Indicators (KRIs) allows for proactive monitoring of conditions that could lead to system unavailability before an incident occurs. Coupled with action plans, this approach provides business management with tangible evidence of ongoing risk management efforts, demonstrating that potential issues are being identified early, monitored, and have predefined responses to help minimize the risk of critical IT system downtime during crucial periods like month-end processing.