Which of the following will BEST quantify the risk associated with malicious users in an organization?

A systems interruption has been traced to a personal USB device plugged into the corporate network by an IT employee who bypassed internal control procedures. Of the following, who should be accountable?

Senior management is deciding whether to share confidential data with the organization's business partners.
The BEST course of action for a risk practitioner would be to submit a report to senior management containing the:

Which of the following would be MOST beneficial as a key risk indicator (KRI)?

Which of the following is MOST important for a risk practitioner to verify when evaluating the effectiveness of an organization's existing controls?