The CIO in a large enterprise is seeking assurance that significant IT risk is being proactively monitored and does not exceed agreed risk tolerance levels.

exams CGEIT CGEIT exam 0 Comments

The CIO in a large enterprise is seeking assurance that significant IT risk is being proactively monitored and does not exceed agreed risk tolerance levels.

The BEST way to provide this ongoing assurance is to require the development of:
A . an IT risk appetite statement.
B . a risk management policy.
C . key risk indicators (KRIs).
D . a risk register.

Answer: C