Section: Volume A
Explanation:
Triggers are warning signs of an upcoming risk event. Here delay in delivery signifies that there may be a risk event like delay in completion of project. Hence it is referred to as a trigger.
Incorrect Answers:
A: Residual risk is the risk that remains after applying controls. But here in this scenario, risk event has not occurred yet.
C: A contingency plan is a plan devised for a specific situation when things go wrong. Contingency plans are often devised by governments or businesses who want to be prepared for anything that could happen. Here there are no such plans.
D: Secondary risks are risks that come about as a result of implementing a risk response. But here in this scenario, risk event has not occurred yet.

Section: Volume D

* IT risk scenarios are hypothetical situations or occurrences that illustrate the potential impact of IT-related threats or opportunities on the organization's objectives, performance, or value creation12.
* Business risk scenarios are hypothetical situations or occurrences that illustrate the potential impact of business-related threats or opportunities on the organization's objectives, performance, or value creation34.
* The best way for the risk practitioner to address the concerns of the business executives who question why they have been assigned ownership of IT-related risk scenarios is to describe IT risk scenarios in terms of business risk, which is a technique that involves translating and communicating the IT risk scenarios into the language and context of the business risk scenarios, and highlighting the linkages and dependencies between them56.
* Describing IT risk scenarios in terms of business risk is the best way because it helps the business executives to understand and appreciate the relevance and importance of IT risk scenarios, and how they affect the achievement of the organization's goals and the delivery of value to the stakeholders56.
* Describing IT risk scenarios in terms of business risk is also the best way because it helps the business executives to accept and fulfill their roles and responsibilities as the owners of IT risk scenarios, and to collaborate and coordinate with the IT team and other stakeholders in the risk management process56.
* The other options are not the best ways, but rather possible alternatives or supplements that may support or enhance the description of IT risk scenarios in terms of business risk. For example:
* Recommending the formation of an executive risk council to oversee IT risk is a way that involves establishing and empowering a group of senior leaders from different business units and functions to provide the strategic direction, guidance, and oversight for the IT risk management process78. However, this way is not the best way because it does not directly address the concerns of the business executives who question why they have been assigned ownership of IT risk scenarios, and it may not be feasible or effective without a clear and common understanding of IT risk scenarios among the council members78.
* Providing an estimate of IT system downtime if IT risk materializes is a way that involves quantifying and communicating the potential loss or disruption of the IT systems or services that support the organization's operations, if the IT risk scenarios occur9 . However, this way is not the best way because it does not fully capture or convey the impact of IT risk scenarios on the
* organization's objectives, performance, or value creation, and it may not be relevant or meaningful for some IT risk scenarios that are not related to IT system downtime9 .
* Educating business executives on IT risk concepts is a way that involves providing and delivering the knowledge and skills on the principles, frameworks, and techniques of IT risk management, and the roles and responsibilities of the IT risk owners and stakeholders . However, this way is not the best way because it does not specifically address the concerns of the business executives who question why they have been assigned ownership of IT risk scenarios, and it may not be sufficient or effective without a practical and contextual application of IT risk concepts to the organization's situation and goals . References =
* 1: IT Scenario Analysis in Enterprise Risk Management - ISACA2
* 2: New Toolkit and Course From ISACA Help Practitioners Develop Risk Scenarios - ISACA1
* 3: Business Risk - Investopedia3
* 4: Business Risk: Definition, Types, Examples & How to Manage4
* 5: Risk IT Framework, ISACA, 2009
* 6: IT Risk Management Framework, University of Toronto, 2017
* 7: Executive Risk Council - ISACA5
* 8: Executive Risk Council: A Guide to Success6
* 9: IT System Downtime - ISACA7
* : IT System Downtime: Causes, Costs, and How to Prevent It8
* : IT Risk Education - ISACA9
* : IT Risk Education: A Guide to Success

Section: Volume D
Explanation