When assessing the maturity level of an organization's risk management framework, which of the following should be of GREATEST concern to a risk practitioner?

While quantitative analysis is ideal, reliance on qualitative methods is common, especially in less mature programs, and doesn't necessarily indicate a critical failure in the framework's fundamental structure or support.

A GRC tool can enhance efficiency, but its absence doesn't prevent an organization from having a mature, albeit possibly more manual, risk management framework.

Senior management involvement is crucial for setting the tone at the top, allocating necessary resources, defining risk appetite, and ensuring that risk management is integrated into business strategy. Without their active participation, a risk management framework lacks strategic direction, authority, and the necessary support to be truly effective and mature.

Using multiple risk registers can indicate organizational silos or inefficiencies, but it's a procedural issue that can be addressed, and less critical than the fundamental absence of senior leadership engagement.