CRISC · Question #74
Which of the following is the BEST indicator of executive management's support for IT risk mitigation efforts?
The correct answer is B. The percentage of corporate budget allocated to IT risk activities. The most effective indicator of executive management's support for IT risk mitigation efforts is the percentage of the corporate budget allocated to IT risk activities.
Question
Which of the following is the BEST indicator of executive management's support for IT risk mitigation efforts?
Options
- AThe number of stakeholders involved in IT risk identification workshops
- BThe percentage of corporate budget allocated to IT risk activities
- CThe percentage of incidents presented to the board
- DThe number of executives attending IT security awareness training
How the community answered
(44 responses)- A9% (4)
- B73% (32)
- C14% (6)
- D5% (2)
Why each option
The most effective indicator of executive management's support for IT risk mitigation efforts is the percentage of the corporate budget allocated to IT risk activities.
The number of stakeholders in workshops indicates engagement but not necessarily financial or strategic commitment.
The allocation of a significant portion of the corporate budget to IT risk activities is the clearest and most tangible indicator of executive management's support. Financial commitment demonstrates a concrete investment in risk mitigation, reflecting a strategic priority rather than just verbal endorsement or participation in workshops.
Presenting incidents to the board is a reporting function, not a direct indicator of proactive support for mitigation efforts.
Executive attendance at training shows awareness but not the deep, financial, or resource commitment required for robust risk mitigation.
Concept tested: Executive support for risk management
Source: https://www.isaca.org/resources/isaca-journal/issues/2021/volume-6/risk-management-the-need-for-a-funding-formula
Topics
Community Discussion
No community discussion yet for this question.