According to IIA guidance, which of the following activities would typically be examined when using the maturity model approach for assessing an organization's risk management program?

Question

Options

• AMonitor and review
• BPerformance measurement.
• CSetting the context.
• DCommunication.

• A
  71% (20)
• B
  11% (3)
• C
  14% (4)
• D
  4% (1)

Explanation

Monitor and review is the activity most associated with IIA's maturity model approach because the maturity model evaluates how systematically and continuously an organization oversees its risk management program - progressing from ad hoc monitoring to optimized, enterprise-wide review processes. Higher maturity levels are distinguished precisely by the sophistication and consistency of an organization's ongoing oversight mechanisms.

Option B (Performance measurement) is a management control concept broadly applicable across organizational functions, not a defining feature of the risk management maturity model specifically. Option C (Setting the context) is an input activity from frameworks like ISO 31000 that happens at the beginning of the risk management process - it describes the environment, not a capability level assessed by a maturity model. Option D (Communication) is a supporting/enabling activity within risk frameworks, but IIA's maturity model is not specifically structured around evaluating communication practices.

Memory tip: Think of a maturity model like a report card on how grown-up your risk management habits are - and grown-up organizations don't just set up processes, they continuously watch and adjust them. "Mature = Monitor" helps lock in option A.

No community discussion yet for this question.