Which of the following is the PRIMARY objective of aggregating the impact of IT risk scenarios and reflecting the results in the enterprise risk register?

Question

Accepted Answer

B. To ensure IT risk impact can be compared to the IT risk appetite Aggregating IT risk scenarios provides a holistic view of the cumulative impact of IT-related risks, allowing management to compare this total exposure against the organization's established IT risk appetite. This comparison is critical for determining if the overall level of IT risk is acceptable or if further mitigation strategies are required to bring it within tolerance levels.

Answer

A. To ensure IT risk appetite is communicated across the organization While risk appetite communication is important, aggregation itself primarily serves for comparison, not direct communication.

Answer

C. To ensure IT risk ownership is assigned at the appropriate organizational level Risk ownership is assigned at the individual scenario level, and while important, it's not the primary objective of aggregating impacts.

Answer

D. To ensure IT risk scenarios are consistently assessed within the organization Consistent assessment is a prerequisite for meaningful aggregation, not the primary objective of aggregation itself.

Which of the following is the PRIMARY objective of aggregating the impact of IT risk scenarios and reflecting the results in the enterprise risk register?

Question

Options

How the community answered

Why each option

Topics

Community Discussion