A.Closed management action plans from the previous audit

B.A list of identified generic risk scenarios

C.An updated vulnerability management report

D.Annual risk assessment results

A.Risk tolerance

B.Expected frequency and potential impact

C.Enterprise-wide IT risk assessment

D.Risk appetite

A.benchmark with competitor s actions.

B.reference best practice.

C.align with audit results.

D.focus on the business drivers

A.availability and reliability.

B.certification and accreditation.

C.effectiveness and efficiency.

D.confidentiality and integrity.

A.Lack of risk and control procedures

B.Lack of alignment to best practices

C.Lack of management approval

D.Lack of risk assessment