A mature risk management program ensures that risk assessmentsdirectly influence decision-makingto align IT risks with business objectives.
Risk Assessment Results Used for Decision-Making (Correct Answer - A)
Demonstrates that risk management is embedded in business processes.
Enables proactive risk mitigation strategies.
Example:A company identifies a cybersecurity risk and delays the launch of a new cloud service until additional controls are in place.
Risk Owner Evaluating All Risk Attributes (Incorrect - B)
Important, but risk management is a shared responsibility.
Metrics Dashboard Approved by Management (Incorrect - C)
A useful tool, but does not indicate effective risk management.
Regular Updates to the Risk Register (Incorrect - D)
Keeping records updated is necessary but not a strong indicator of maturity.
References:
ISACA CISA Review Manual
COBIT 2019: Risk Governance
ISO 31000 (Risk Management Framework)

Configuring each authentication server as belonging to a cluster of authentication servers is the best way to minimize performance degradation of servers used to authenticate users of an e- commerce website. A cluster is a group of servers that work together to provide high availability, load balancing, and fault tolerance. If one server fails or becomes overloaded, another server in the cluster can take over its workload without disrupting the service. A single server as a primary authentication server and a second server as a secondary authentication server is not as effective as a cluster, because the secondary server is only used when the primary server fails, which means it is idle most of the time and does not improve performance. Configuring each authentication server and ensuring that each disk of its RAID is attached to the primary controller does not address the issue of performance degradation, but rather the issue of data redundancy and reliability.
RAID (redundant array of independent disks) is a technology that combines multiple disks into a logical unit that can tolerate disk failures and improve data access speed. Configuring each authentication server and ensuring that the disks of each server form part of a duplex does not address the issue of performance degradation, but rather the issue of data backup and recovery. A duplex is a pair of disks that store identical copies of data, so that if one disk fails, the other disk can be used to restore the data. References: ISACA CISA Review Manual 27th Edition, page 310

The business impact analysis (BIA) is a critical component of an organization ' s business continuity planning (BCP) process. The most concerning issue is when system criticality information is provided only by the IT manager (Option B). This presents a risk of bias or incomplete analysis, as business units must also provide input to ensure a comprehensive assessment.
ISACA CISA Reference: According to ISACA's BCP and DRP guidelines, BIA should involve input from multiple business functions, including finance, operations, and risk management, rather than relying solely on IT.
Risk Implication: Without broader business input, the criticality of systems may be misclassified, leading to incorrect recovery priorities and potential business disruption.
Alternative Choices:
Option A: While a risk assessment is important, a BIA can still be completed without it and later validated.
Option C: The use of questionnaires is a valid method if responses are verified.
Option D: Lack of executive sign-off is concerning but does not directly impact the accuracy of system criticality assessment.