Which of the following should be the PRIMARY basis for determining risk appetite?

The correct answer is D. Organizational objectives. Risk appetite defines how much risk an organization is willing to accept in pursuit of its goals. Because risk appetite exists to support the achievement of organizational objectives, those objectives must be its primary basis. Audit findings (A) identify gaps but don't define…

Submitted by cyberguy42· Apr 18, 2026Information Security Governance

Question

Options

AIndependent audit findings
BResidual risk level
CRisk assessment results
DOrganizational objectives

How the community answered

(18 responses)

A
6% (1)
D
94% (17)

Explanation

Risk appetite defines how much risk an organization is willing to accept in pursuit of its goals. Because risk appetite exists to support the achievement of organizational objectives, those objectives must be its primary basis. Audit findings (A) identify gaps but don't define appetite. Residual risk (B) is an output of risk management, not an input to appetite-setting. Risk assessment results (C) inform discussions but are secondary to the strategic direction set by organizational objectives.

Topics

#Risk appetite#Organizational objectives#Information security governance#Strategic risk management

Community Discussion

No community discussion yet for this question.

Full CISM Practice