A.Monitor key indicators (KRIs)

B.Monitor key performance indicators (KPIs)

C.Conduct a gap analysis

D.Interview the risk owner

A.Verify the effectiveness of the original mitigation plan.

B.Consult the internal auditor for a second opinion.

C.Update the status of the control as obsolete.

D.Obtain approval to retire the control.

A.Percentage of vulnerabilities remediated within the agreed service level

B.Number of vulnerabilities identified during the period

C.Percentage of vulnerabilities escalated to senior management

D.Number of vulnerabilities re-opened during the period

A.reflect the results of risk assessments.

B.effectively support a business maturity model.

C.be available to operational risk groups.

D.be reviewed by the IT steering committee.

A.understanding the organization's risk appetite.

B.mapping residual risk with cost of controls

C.comparing industry risk appetite with the organization's.

D.comparing against regulatory requirements