Comprehensive and Detailed Step-by-Step Explanation:
A mature risk management program ensures that risk assessmentsdirectly influence decision-makingto align IT risks with business objectives.
* Risk Assessment Results Used for Decision-Making (Correct Answer - A)
* Demonstrates that risk management is embedded in business processes.
* Enables proactive risk mitigation strategies.
* Example:A company identifies a cybersecurity risk and delays the launch of a new cloud service until additional controls are in place.
* Risk Owner Evaluating All Risk Attributes (Incorrect - B)
* Important, but risk management is a shared responsibility.
* Metrics Dashboard Approved by Management (Incorrect - C)
* A useful tool, but does not indicate effective risk management.
* Regular Updates to the Risk Register (Incorrect - D)
* Keeping records updated is necessary but not a strong indicator of maturity.
References:
* ISACA CISA Review Manual
* COBIT 2019: Risk Governance
* ISO 31000 (Risk Management Framework)