Enterprise architecture (EA) documentation provides the most useful information to trace the impact of aggregated risk across the organization's technical environment, because it describesthe structure and behavior of the organization's IT systems, applications, infrastructure, and processes, and how they support and enable the organization's strategy and objectives. EA documentation also defines the principles, standards, and guidelines that govern the design and implementation of the IT solutions and services.
Aggregated risk is the total or combined level of risk that the organization faces from multiple or interrelated sources or scenarios. Aggregated risk may have a greater impact than the sum of the individual risks, due to the synergistic or compounding effects of the risks. The technical environment is the set of IT components and capabilities that support the organization's business functions and processes. Tracing the impact of aggregated risk across the technical environment is a process of identifying and assessing the potential or actual consequences of the aggregated risk on the performance, functionality, or security of the IT systems, applications, infrastructure, or processes. EA documentation provides the most useful information, as it helps to understand and analyze the interdependencies and relationships of the IT components and capabilities, andto evaluate the effect of the aggregated risk on the alignment and integration of IT with the organization's strategy and objectives. Business case documentation, organizational risk appetite statement, and organizational hierarchy are all possible sources of information to trace the impact of aggregated risk, but they are not the most useful information, as they do not provide a comprehensive and detailed view of the technical environment and its architecture. References = Risk and Information Systems Control Study Manual, Chapter
5, Section 5.2.1, page 183