Section: Volume C
Explanation:
The organizational levels of the COSO ERM framework describe the subsidiary, business unit, division, and entity-levels of aspects of risk solutions.
Incorrect Answers:
B: Risk components includes Internal Environment, Objectives settings, Event identification, Risk assessment, Risk response, Control activities, Information and communication, and monitoring.
C: Strategic objectives includes strategic, operational, reporting, and compliance risks; and not entity-based risks.
D: This is not a valid answer.

D, and C are incorrect. These are also the objectives of the information system control but are not the best answer.

Section: Volume C
Explanation/Reference:
Explanation:
Threat and vulnerability assessment consider the full spectrum of risks. It identifies the likelihood of occurrence of risks and impact of the significant risks on the organization using the risk scenarios. For example: Natural threats can be evaluated by using historical data concerning frequency of occurrence for given natural disasters such as tornadoes, hurricanes, floods, fire, etc.
Incorrect Answers:
A, B: These use either some technical evaluation tool or assessment methodologies to evaluate risk but do not use risk scenarios.
D: Risk assessment uses quantitative and qualitative analysis approaches to evaluate each significant risk identified.