A mature risk management program ensures that risk assessmentsdirectly influence decision-makingto align IT risks with business objectives.
Risk Assessment Results Used for Decision-Making (Correct Answer - A)
Demonstrates that risk management is embedded in business processes.
Enables proactive risk mitigation strategies.
Example:A company identifies a cybersecurity risk and delays the launch of a new cloud service until additional controls are in place.
Risk Owner Evaluating All Risk Attributes (Incorrect - B)
Important, but risk management is a shared responsibility.
Metrics Dashboard Approved by Management (Incorrect - C)
A useful tool, but does not indicate effective risk management.
Regular Updates to the Risk Register (Incorrect - D)
Keeping records updated is necessary but not a strong indicator of maturity.
References:
ISACA CISA Review Manual
COBIT 2019: Risk Governance
ISO 31000 (Risk Management Framework)