CGEIT · Question #656
To define the risk management strategy, which of the following MUST be set by the board of directors?
The correct answer is D. Risk appetite. The board of directors is responsible for setting the organization's overall risk appetite, which then guides the entire risk management strategy and subsequent activities.
Question
To define the risk management strategy, which of the following MUST be set by the board of directors?
Options
- ARisk management process
- BRisk identification plan
- CRisk treatment plan
- DRisk appetite
How the community answered
(17 responses)- A6% (1)
- B6% (1)
- D88% (15)
Why each option
The board of directors is responsible for setting the organization's overall risk appetite, which then guides the entire risk management strategy and subsequent activities.
The risk management process outlines how risks are managed, but it is built upon the foundational risk appetite set by the board.
A risk identification plan is a component of the risk management process, detailing how risks will be identified, not the overarching strategic parameter.
A risk treatment plan specifies how identified risks will be mitigated or responded to, which is an operational detail derived from the risk appetite and strategy.
The board of directors, as the highest governing body, establishes the organization's risk appetite, defining the level of risk the enterprise is willing to accept or tolerate in pursuit of its objectives. This fundamental parameter dictates the boundaries for all risk management activities, ensuring alignment with strategic goals and shareholder interests.
Concept tested: Board's role in risk governance and appetite
Topics
Community Discussion
No community discussion yet for this question.