SSCP · Question #1137
What is the main goal of a risk management program?
The correct answer is B. To help managers find the correct cost balance between risks and countermeasures. The main goal of a risk management program is to help managers find the optimal cost balance between mitigating identified risks and the cost of implementing countermeasures.
Question
What is the main goal of a risk management program?
Options
- ATo develop a disaster recovery plan
- BTo help managers find the correct cost balance between risks and countermeasures
- CTo evaluate appropriate risk mitigation scenarios
- DTo calculate ALE formulas
- ENone of the above
How the community answered
(33 responses)- A3% (1)
- B88% (29)
- C6% (2)
- E3% (1)
Why each option
The main goal of a risk management program is to help managers find the optimal cost balance between mitigating identified risks and the cost of implementing countermeasures.
Developing a disaster recovery plan is a specific risk mitigation strategy within business continuity, not the overarching main goal of a risk management program itself.
Risk management aims to ensure that the cost of implementing security countermeasures does not exceed the potential financial impact of the risk they are designed to mitigate, achieving an acceptable level of residual risk.
Evaluating risk mitigation scenarios is an activity performed within a risk management program, but the primary goal is the strategic balancing of cost and risk, not just scenario assessment.
Calculating Annualized Loss Expectancy (ALE) is a specific quantitative risk analysis technique used within a risk management program, not the program's main objective.
Concept tested: Purpose of risk management
Source: https://www.isaca.org/resources/isaca-journal/issues/2012/volume-2/how-to-implement-an-effective-it-risk-management-program
Topics
Community Discussion
No community discussion yet for this question.