Section: Volume C
Explanation:
An enterprise's risk management capability maturity level is 3 when:
* Risk management is viewed as a business issue, and both the drawbacks and benefits of risk are recognized.
* There is a selected leader for risk management, engaged with the enterprise risk committee, across the enterprise.
* The business knows how IT fits in the enterprise risk universe and the risk portfolio view.
* Local tolerances drive the enterprise risk tolerance.
* Risk management activities are being aligned across the enterprise.
* Formal risk categories are identified and described in clear terms.
* Situations and scenarios are included in risk awareness training beyond specific policy and structures and promote a common language for communicating risk.
* Defined requirements exist for a centralized inventory of risk issues.
* Workflow tools are used to accelerate risk issues and track decisions.
Incorrect Answers:
C: Enterprise having risk management capability maturity level 5 requires continuous improvement of risk management skills, based on clearly defined personal and enterprise goals.

Section: Volume B
Explanation:
The primary function of the enterprise is to meet its objective. Each business activity for fulfilling enterprise's objective carries both risk and opportunity, therefore objective should be considered while managing risk.
Open and fair communication should me there for effective risk management. Open, accurate, timely and transparent information on lT risk is exchanged and serves as the basis for all risk-related decisions.
Cost-benefit analysis should be done for proper weighing the total costs expected against the total benefits expected, which is the major aspect of risk management.
Incorrect Answers:
A: For effective risk management, there should be continuous improvement, not consistent. Because of the dynamic nature of risk, risk management is an iterative, perpetual and ongoing process; that's why, continuous improvement is required.

Section: Volume B
Explanation:
If it is necessary to quickly implement control by applying technical solution that deviates from the company's policies, then risk assessment should be conducted to clarify the risk. It is up to the management to accept the risk or to mitigate it.
Incorrect Answers:
A: As in this case it is important to mitigate the risk, hence risk professional should once recommend a risk assessment. Though the decision for the conduction of risk assessment in case of violation of company's policy, is taken by management.
B: The recommendation to revise the current policy should not be triggered by a single request.
D: Risk professional can only recommend the risk assessment if the company's policies is violating, but it can only be conducted when the management allows.