A.Existing IT environment

B.Risk register

C.Organizational strategic plan

D.IT strategic plan

A.Evaluating the residual risk level.

B.Identifying key risk indicators.

C.Evaluating the return on investment.

D.Performing a cost-benefit analysis.

A.Impact rating

B.Control effectiveness

C.Likelihood rating

D.Assessment approach

A.To reduce the risk to a level that the enterprise is willing to accept

B.To reduce the risk to the point at which the benefit exceeds the expense

C.To reduce the risk to a level that is too small to be measurable

D.To reduce the risk to a rate of return that equals the current cost of capital

E.Explanation:
Risk cannot be removed completely from the enterprise; it can only be reduced to a level that an
organization is willing to accept. Risk management programs are hence designed to accomplish
the task of reducing risks.

F.is incorrect. Depending on the risk preference of an enterprise, it may or may not
choose to pursue risk mitigation to the point at which benefit equals or exceeds the expense.
Hence this is not the primary objective of designing the risk management program.

G.is incorrect. Reducing risk to a level too small to measure is not practical and is often
cost-prohibitive.

A.conduct and document a business impact analysis (BIA).

B.verify cost-benefit of the new controls being implemented.

C.ensure risk monitoring for the project is initiated.

D.update the risk register to reflect the correct level of residual risk.