Which of the following is the MOST important consideration when defining control objectives?

The correct answer is B. Risk appetite. Risk appetite reflects how much risk the organization is willing to tolerate. It is the primary driver when defining control objectives, ensuring alignment with overall business strategy. "Risk appetite should be used to guide the selection and design of control objectives to…

Submitted by diego_uy· Apr 18, 2026Information Security Risk Management

Question

Options

ASenior management support
BRisk appetite
CThreat environment
DBudget allocation

How the community answered

(31 responses)

A
3% (1)
B
77% (24)
C
13% (4)
D
6% (2)

Explanation

Risk appetite reflects how much risk the organization is willing to tolerate. It is the primary driver when defining control objectives, ensuring alignment with overall business strategy. "Risk appetite should be used to guide the selection and design of control objectives to ensure risk is managed within acceptable boundaries." Support, budget, and threats matter, but without alignment to risk appetite, controls may be

Topics

#Control Objectives#Risk Appetite#Information Security Controls#Risk Management Strategy

Community Discussion

No community discussion yet for this question.

Full CISM Practice