and C are incorrect. Identifying the information to be reviewed and information collected during each stage of project is done in pre-project phase and not during project for effective post-implementation review. Answer:B is incorrect. Executing sufficient number of business cycles in the new system is done after the completion of the project.

Explanation/Reference:
Explanation:
Risk communication is a critical part in the risk management process. People are naturally uncomfortable talking about risk and tend to put off admitting that risk is involved and communicating about issues; incidents; and; eventually, even crises.
If risk is to be managed and mitigated, it must first be discussed and effectively communicated throughout an enterprise.
Incorrect Answers:
B: Auditing is done to test the overall risk management process and the planned risk responses. So it is the very last phase after completion of risk management process.
C: Risk monitoring is the last phase to complete risk management process, and for proper management of risk it should be communicated properly. Hence risk communication is the most crucial step.
D: Risk mitigation is one of the phases of risk management process for effective mitigation of risk it should be first communicated throughout an enterprise.

Section: Volume A
Explanation:
The risk response process is triggered when a risk exceeds the enterprise's risk tolerance level. The acceptable variation relative to the achievement of an objective is termed as risk tolerance. In other words, risk tolerance is the acceptable deviation from the level set by the risk appetite and business objectives.
Risk tolerance is defined at the enterprise level by the board and clearly communicated to all stakeholders. A process should be in place to review and approve any exceptions to such standards.
Incorrect Answers:
A, C: Risk appetite level is not relevant in triggering of risk response process. Risk appetite is the amount of risk a company or other entity is willing to accept in pursuit of its mission. This is the responsibility of the board to decide risk appetite of an enterprise. When considering the risk appetite levels for the enterprise, the following two major factors should be taken into account:
* The enterprise's objective capacity to absorb loss, e.g., financial loss, reputation damage, etc.
* The culture towards risk taking-cautious or aggressive. In other words, the amount of loss the enterprise wants to accept in pursue of its objective fulfillment.
D: Risk response process is triggered when the risk level increases the risk tolerance level of the enterprise, and not when it just equates the risk tolerance level.

Section: Volume D
Explanation:
The lack of any significant differences between perpetual levels and actual levels provides indirect information that its billing controls are operating. It does not provide any direct information.
Incorrect Answers:
A: It does not provide direct information as there is no information about the propriety of cutoff.
C, D: These are not the types of information.