A business continuity plan (BCP) relies on clear roles and responsibilities to ensure effective execution during a disruption. The CGEIT Review Manual 8th Edition emphasizes that defined roles are the most critical component for BCP success, as they ensure accountability and coordination.
* Extract from CGEIT Review Manual 8th Edition (Domain 3: Risk Optimization):"The most important element for executing a business continuity plan is the definition of roles and responsibilities. Clear roles ensure that all stakeholders know their duties during a disruption, enabling rapid and coordinated response." (Approximate reference: Domain 3, Section on Business Continuity Planning) Defined roles (option A) are essential to ensure that the BCP is actionable, with individuals assigned to specific tasks, such as communication, recovery, or coordination.
* Why not the other options?
* B. Replicated systems: Systems are important but useless without people to manage them during a crisis.
* C. A risk register: A risk register identifies risks but does not ensure BCP execution.
* D. Budget allocation: Funding supports BCP development but is not the most critical for execution.
References:
ISACA CGEIT Review Manual 8th Edition, Domain 3: Risk Optimization, Section on Business Continuity and Disaster Recovery.
ISACA CGEIT Study Guide, Chapter on BCP Execution.

The best reference for the IT steering committee as they evaluate the level of success of a strategic systems project that was implemented several months ago is the project's business case. The business case is the document that outlines the rationale, objectives, benefits, costs, risks, and assumptions of the project. It also defines the expected outcomes and performance indicators that can be used to measure the project's success. By comparing the actual results of the project with the business case, the IT steering committee can determine if the project has met its intended goals, delivered its expected value, and justified its investment

Final approval for accepting the associated IT risk should be obtained from the business sponsor. This is because the business sponsor is the person or group who initiates, funds, and owns the business case for the mobile sales channel project1. The business sponsor is responsible for defining the business objectives, benefits, and requirements of the project, and for ensuring its alignment with the enterprise strategy1. The business sponsor is also accountable for the outcomes and value of the project, and for managing the risks and issues that may affect its success1. Therefore, the business sponsor should have the authority and responsibility to approve the IT risk associated with the mobile sales channel project, as it may impact the business performance and value.
The other options, risk manager, chief information officer (CIO), and IT steering committee are not the best choices for obtaining final approval for accepting the associated IT risk. They are more involved in the identification, assessment, mitigation, and monitoring of IT risks, rather than their acceptance2. They may also have different perspectives and interests than the business sponsor regarding the IT risk associated with the mobile sales channel project. For example, the risk manager may focus on minimizing or avoiding IT risks, while the CIO may focus on maximizing or exploiting IT opportunities. The IT steering committee may have a broader view of IT risks across multiple projects and programs, rather than a specific one. Therefore, they may not have the final say or decision on accepting the IT risk associated with the mobile sales channel project.