Explanation/Reference:
Explanation:
A successful risk management practice minimizes the residual risk to the organization. Choice A is incorrect because the fact that overall risk has been quantified does not necessarily indicate the existence of a successful risk management practice. Choice B is incorrect since it is virtually impossible to eliminate inherent risk. Choice D is incorrect because, although the tying of control risks to business may improve accountability, this is not as desirable as minimizing residual risk.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT

Section: INCIDENT MANAGEMENT AND RESPONSE

Section: MIXED QUESTIONS

Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation:
Without security awareness training, many components of the security program may not be effectively implemented. The other options may or may not be necessary, but are discretionary.