A new technique exploited by cybercriminals represents a threat (B). In CISM terminology, a threat is any circumstance or event with the potential to adversely impact an asset by exploiting a vulnerability. A risk (A) requires both a threat and a vulnerability with associated impact. An incident (C) is a realized event that compromises security, and an event (D) is an observable occurrence that may or may not lead to an incident.
Identifying new threat techniques is a key part of proactive risk management and threat intelligence activities emphasized in CISM.
References: ISACA CISM Review Manual (Risk management-threats, vulnerabilities, and risk definitions); CISM Exam Content Outline (Domain 1).

Documenting information security responsibilities within job descriptions is the most effective way to convey information security responsibilities across an organization because it clearly defines the roles, expectations, and accountabilities of each employee regarding information security. It also helps to align the information security objectives with the business goals and performance indicators, and to ensure compliance with the security policies and standards.
References = CISM Review Manual 15th Edition, What is CISM? - Digital Guardian

The primary basis for establishing metrics that measure the effectiveness of an information security program should be the risk tolerance of the organization, which is the degree of risk that the organization is willing to accept or avoid in pursuit of its objectives. Metrics based on risk tolerance can help to evaluate whether the information security program is aligned with the business strategy, supports the risk management process, and delivers value to the organization. Residual risk, regulatory requirements, and control objectives are also important factors to consider when developing metrics, but they are not as fundamental as the risk tolerance.
References = CISM Review Manual, 16th Edition, page 69