An IS auditor is reviewing an organization's risk management program. Which of the following should be the PRIMARY driver of the enterprise IT risk appetite?

The correct answer is C. Strategic objectives. The organization’s strategic objectives are the primary driver of its IT risk appetite because risk tolerance must align with the overall business strategy. This ensures that risk-taking supports the achievement of strategic goals while maintaining an acceptable level of…

Submitted by takeshi77· Apr 18, 2026Governance and Management of IT

Question

Options

AReturn on investment (ROI)
BCost of implementing controls
CStrategic objectives
DLikelihood of risk events

How the community answered

(33 responses)

A
6% (2)
B
3% (1)
C
88% (29)
D
3% (1)

Explanation

The organization’s strategic objectives are the primary driver of its IT risk appetite because risk tolerance must align with the overall business strategy. This ensures that risk-taking supports the achievement of strategic goals while maintaining an acceptable level of exposure.

Topics

#Risk Appetite#Strategic Alignment#Enterprise Risk Management

Community Discussion

No community discussion yet for this question.

Full CISA Practice