Which of the following will BEST help to ensure the continued effectiveness of the IT risk management function within an organization experiencing high employee turnover?

Well-documented policies and procedures define how risk management should be performed, but without effective tracking of actual risks and issues, the substance of the risk environment can be lost with departing employees.

Risk and issue tracking is paramount in an organization with high employee turnover because it centralizes and preserves institutional knowledge about identified risks, their status, mitigation plans, and associated issues. This ensures that even as personnel change, critical risk information remains accessible and actionable, allowing new team members to quickly understand and continue managing the organization's risk posture effectively.

An IT strategy committee provides governance and strategic direction but does not directly ensure the operational continuity and effectiveness of the day-to-day IT risk management function amidst staff changes.

Change and release management focuses on controlling changes to IT systems and services, which is a related but separate function from the overall continuity of the IT risk management process and its knowledge base.