Section: Volume C
Explanation:
The inputs to the plan risk management process are as follows:
* Project scope statement: It provides a clear sense of the range of possibilities associated with the project and establishes the framework for how significant the risk management effort may become.
* Cost management plan: It describes how risk budgets, contingencies, and management reserves will be reported and accessed.
* Schedule management plan: It describes how the schedule contingencies will be reported and assessed.
* Communication management plan: It describes the interactions, which occurs on the project and determines who will be available to share information on various risks and responses at different times.
* Enterprise environmental factors: It include, but are not limited to, risk attitudes and tolerances that describe the degree of risk that an organization withstand.
* Organizational process assets: It includes, but are not limited to, risk categories, risk statement formats, standard templates, roles and responsibilities, authority levels for decision-making, lessons learned, and stakeholder registers.
Incorrect Answers:
A: It is not an input for Plan risk management process.

* An effective risk management program is a systematic and consistent process of identifying, analyzing, evaluating, treating, monitoring, and communicating risks that may affect the achievement of the
* organization's objectives12.
* The best indication of an effective risk management program is that the residual risk, which is the risk remaining after risk treatment, is within the organizational risk appetite, which is the amount and type of risk that the organization is willing to accept in pursuit of its objectives12.
* This indicates that the organization has successfully implemented appropriate risk responses that align with its risk strategy and criteria, and that the organization is able to balance the potential benefits and costs of taking risks12.
* The other options are not the best indication, but rather components or outcomes of an effective risk management program. For example:
* Risk action plans are approved by senior management is an outcome of an effective risk management program that demonstrates the commitment and accountability of the leadership for risk management12.
* Mitigating controls are designed and implemented is a component of an effective risk management program that involves reducing the likelihood or impact of a risk event12.
* Risk is recorded and tracked in the risk register is a component of an effective risk management program that involves documenting and updating the risk information and status12. References =
* 1: Risk IT Framework, ISACA, 2009
* 2: IT Risk Management Framework, University of Toronto, 2017

Section: Volume C
Explanation:
Complexity of the organizational structure will have the most significant impact on the Information security governance model. Some of the elements that impact organizational structure are multiple business units and functions across the organization.
Incorrect Answers:
A: Currency with changing legislative requirements should not have major impact once good governance models are placed, hence, governance will help in effective management of the organization's ongoing compliance.
B, D: The numbers of employees and the distance between physical locations have less impact on Information security models as well-defined process, technology and people components together provide the proper governance.

Section: Volume D