Which of the following BEST facilitates accountability and ownership of risk in an organization?

The correct answer is C. Adoption of a risk and control framework. A risk and control framework (such as COBIT, ISO 31000, or NIST RMF) formally defines roles, responsibilities, and ownership for specific risks and controls across the organization. It institutionalizes accountability by embedding it into governance structures and…

Submitted by layla.eg· Apr 18, 2026Information Security Governance

Question

Options

ADefined operational procedures
BEmployee awareness and education
CAdoption of a risk and control framework
DAppropriate policies and standards

How the community answered

(24 responses)

A
13% (3)
B
4% (1)
C
79% (19)
D
4% (1)

Explanation

A risk and control framework (such as COBIT, ISO 31000, or NIST RMF) formally defines roles, responsibilities, and ownership for specific risks and controls across the organization. It institutionalizes accountability by embedding it into governance structures and decision-making processes. Policies and standards support the framework but don't inherently assign ownership. Operational procedures are tactical, and awareness training educates employees - neither creates the formal accountability structures that a framework does.

Topics

#Risk accountability#Risk ownership#Risk frameworks#Information security governance

Community Discussion

No community discussion yet for this question.

Full CISM Practice