An enterprise has decided to execute a risk self-assessment to identify improvement opportunities for current IT services. Which of the following is MOST important to address in the assessment?
Correct Answer: C
Mapping of business objectives to IT risk is the most important factor to address in a risk self-assessment for current IT services, because it helps to align the IT risk management strategy with the business strategy and goals. Mapping of business objectives to IT risk also helps to identify and prioritize the key IT risks that could affect the achievement of the business objectives, and to determine the appropriate risk responses and controls. Mapping of business objectives to IT risk also helps to communicate the value and benefits of IT risk management to the business stakeholders, and to foster a risk-aware culture within the organization. One of the sources that supports this answer is A Comprehensive Guide To Risk And Control Self -Assessment RCSA, which states that "RCSA aims to include the use of risk management techniques, business processes, and cultures in staff work and businesses to achieve objectives."
CGEIT Exam Question 287
A board of directors is concerned that a major IT implementation has the potential to significantly disrupt enterprise operations. Which of the following would be MOST helpful in identifying the extent of the potential impact of the disruption?
Correct Answer: C
A risk assessment of the implementation would be most helpful in identifying the extent of the potential impact of the disruption, as it would evaluate the likelihood and consequences of various scenarios that could affect the enterprise operations. A risk assessment would also help to identify and prioritize the mitigation strategies and contingency plans for the implementation. References := CGEIT Exam Content Outline, Domain 4, Subtopic B: IT Risk Management, Task 1: Ensure that an IT risk management framework exists to identify, analyze, mitigate, manage, monitor, and communicate IT-related business risk, and that the framework for IT risk management is in alignment with the enterprise risk management (ERM) framework1.
