Risk acceptancemeanschoosing not to take immediate actionto mitigate the risk, making it thelowest- costapproach in the short term.
Risk Acceptance (Correct Answer - B)
The organizationacknowledges the riskand decides toaccept itwithout implementing additional controls.
Example:A small companyaccepts the riskof not segregating financial duties due to limited staff.
Risk Mitigation (Incorrect - A)
Requiresimplementing controls, whichincur costs.
Risk Transference (Incorrect - C)
Involvesoutsourcing risk(e.g., buying insurance), which hasfinancial costs.
Risk Reduction (Incorrect - D)
Involvesapplying security controls, leading to additional costs.
References:
ISACA CISA Review Manual
ISO 31000 (Risk Management Framework)

The business case defines the project's expected benefits, success criteria, and performance metrics.
Reviewing the business case allows the auditor to assess whether the benefits identified at initiation have been realized post-implementation. The schedule (B) only tracks timeliness, not value. Proposed enhancements (C) address future improvements, not whether benefits have been delivered. QA results (D) reflect product quality but not business value. ISACA emphasizes that value delivery and benefits realization are key elements of enterprise governance of IT, aligning with COBIT's EDM02 (Ensure Benefits Delivery).
References (ISACA): COBIT 2019, EDM02 Ensure Benefits Delivery.

Digital watermarks are hidden marks or codes that can be embedded into digital files, such as images, videos, audio, or documents. They can be used to identify the source, owner, or authorized user of the data, as well as to track any unauthorized copying or distribution of the data. Digital watermarks can help prevent data leakage by deterring potential leakers from sharing sensitive data or by providing evidence of data leakage if it occurs.
The other options are not as effective as digital watermarks in preventing data leakage. Ensuring that paper documents are disposed securely can reduce the risk of physical data leakage, but it does not address the digital data leakage that is more prevalent in today's environment. Implementing an intrusion detection system (IDS) can help detect and respond to cyberattacks that may cause data leakage, but it does not prevent data leakage from insiders or authorized users who have legitimate access to the data. Verifying that application logs capture any changes made can help audit and investigate data leakage incidents, but it does not prevent them from happening in the first place.
References:
What is Data Leakage?
What is Digital Watermarking?