is incorrect. Benchmarking compares any two items, such as materials, vendors, or
resources.

Explanation/Reference:
Explanation:
An enterprise's risk management capability maturity level is 1 when:
There is an understanding that risk is important and needs to be managed, but it is viewed as a

technical issue and the business primarily considers the downside of IT risk.
Any risk identification criteria vary widely across the enterprise.

Risk appetite and tolerance are applied only during episodic risk assessments.

Enterprise risk policies and standards are incomplete and/or reflect only external requirements and lack

defensible rationale and enforcement mechanisms.
Risk management skills exist on an ad hoc basis, but are not actively developed.

Ad hoc inventories of controls that are unrelated to risk are dispersed across desktop applications.

Incorrect Answers:
A: In level 3 of risk management capability maturity model, local tolerances drive the enterprise risk tolerance.
B: In level 2 of risk management capability maturity model, risk tolerance is set locally and may be difficult to aggregate.
C: In level 4 of risk management capability maturity model, business risk tolerance is reflected by enterprise policies and standards reflect.

Discussing and managing risk as a team is the greatest benefit for an organization with a strong risk awareness culture, as it enables the organization to share and communicate the risk information and knowledge among all the stakeholders, and to collaborate and coordinate the risk management activities and responsibilities.
Discussing and managing risk as a team can also help to foster a positive and proactive attitude toward risk, and to align the risk management process with the organization's strategy and objectives. Discussing and managing risk as a team can also enhance the risk governance and accountability, and support the risk learning and improvement. References = Most Asked CRISC Exam Questions and Answers. CRISC: Certified in Risk
& Information Systems Control Sample Questions, Question 252. ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 252. CRISC by Isaca Actual Free Exam Q&As, Question 9.

Section: Volume C
Explanation:
Vulnerabilities detected during assessment should be first evaluated for threat, impact and cost of mitigation. It should be evaluated and prioritized on the basis whether they impose credible threat or not.
Incorrect Answers:
A, C: These are the further steps that are taken after evaluating vulnerabilities. So, these are not immediate action after detecting vulnerabilities.
B: If detected vulnerabilities impose no/negligible threat on an enterprise then it is not cost effective to address it as risk.