Explanation/Reference:
Explanation:
Threats and vulnerabilities change over time and KRI maintenance ensures that KRIs continue to effectively capture these changes.
The risk environment is highly dynamic as the enterprise's internal and external environments are constantly changing. Therefore, the set of KRIs needs to be changed over time, so that they can capture the changes in threat and vulnerability.
Incorrect Answers:
A: Risk avoidance is one possible risk response. Risk responses are based on KRI reporting, but is not the reason for maintenance of KRIs.
B: While most key risk indicator (KRI) metrics need to be optimized in respect to their sensitivity, the most important objective of KRI maintenance is to ensure that KRIs continue to effectively capture the changes in threats and vulnerabilities over time. Hence the most important reason is that because of change of threat and vulnerability overtime.
C: Risk reporting timeliness is a business requirement, but is not a reason for KRI maintenance.

The second line of defense is responsible for challenging the risk decision making of the first line of defense, which is the business process owners and managers. The second line of defense also provides oversight, guidance, and support to the first line of defense in implementing and maintaining effective risk management practices. The second line of defense includes functions such as risk management, compliance, quality assurance, and internal audit. References = Risk and Information Systems Control Study Manual, Chapter 1:
IT Risk Identification, Section 1.2: IT Risk Management Roles and Responsibilities, Page 14.

is incorrect. The risk low-level watch list is for identified risks that have low impact and
low probability in the project.

Section: Volume D