Certified in Risk and Information Systems Control: CRISC

Which of the following statements BEST describes risk appetite?

A. The amount of risk an organization is willing to accept

B. The effective management of risk and internal control environments

C. Acceptable variation between risk thresholds and business objectives

D. The acceptable variation relative to the achievement of objectives

Which of the following BEST enables risk-based decision making in support of a business continuity plan (BCP)?

A. Impact analysis

B. Control analysis

C. Root cause analysis

D. Threat analysis

Which of the following is MOST important to include in an IT risk management policy?

A. Risk treatment types

B. Risk ownership requirements

C. Risk assessment requirements

D. Risk scoring methodology