A.impacts are recorded in qualitative terms.

B.executive management does not perform periodic reviews.

C.significant changes in risk factors are excluded.

D.IT risk is not linked with IT assets.

A.confirm the organization s risk appetite and tolerance

B.review alignment with the organization's investment plan

C.report identified IT risk scenarios to senior management

D.create new control processes to reduce identified IT risk scenarios

A.Reviewing database access rights

B.Reviewing database activity logs

C.Comparing data to input records

D.Reviewing changes to edit checks

A.as input foe decision-making

B.for compliance with laws and regulations

C.to measure organizational success.

D.as a basis for cost-benefit analysis.

A.Risk mitigation

B.Risk assessment

C.Risk aggregation

D.Risk monitoring