Which of the following will BEST help to ensure enterprise IT risk is effectively managed?

An audit committee reporting to the board provides oversight but does not directly establish the operational or strategic management of IT risk within the executive structure.

Establishing clear roles and responsibilities for IT risk at the senior management level is paramount because it ensures accountability for risk decisions, drives strategic prioritization of risk mitigation efforts, and embeds risk management into the enterprise's overall governance structure. This ensures IT risk is treated as a strategic business concern, not just an operational one.

Outsourcing low IT risks is a risk response strategy, but it does not ensure *effective management* of enterprise IT risk as a whole, nor does it address accountability for risk.

Assigning a project sponsor and project manager for an IT risk register helps implement a tool, but it doesn't establish the comprehensive governance and accountability for *managing* IT risk across the enterprise, especially at a strategic level.