The best key performance indicator (KPI) to measure the effectiveness of a disaster recovery test of critical business processes is the percentage of processes recovered within the recovery time and point objectives.
Recovery time objective (RTO) is the maximum acceptable time period within which a business process or an IT service must be restored after a disruption. Recovery point objective (RPO) is the maximum acceptable amount of data loss measured in time before the disruption. The percentage of processes recovered within the RTO and RPO indicates how well the disaster recovery test meets the business continuity and recovery requirements and expectations, and how effectively the disaster recovery plan and procedures are executed.
The percentage of processes recovered within the RTO and RPO can also help to identify the gaps, weaknesses, and opportunities for improvement in the disaster recovery capabilities. Percentage of job failures identified and resolved during the recovery process, number of current test plans and procedures, and number of issues and action items resolved during the recovery test are not as good as the percentage of processes recovered within the RTO and RPO, as they do not directly measure the achievement of the recovery objectives, and may not reflect the actual impact and performance of the disaster recovery test. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 130.

The risk owner is the person or entity that has the accountability and authority to manage a risk. The risk owner should be accountable for monitoring the control environment to ensure controls are effective, as they are responsible for implementing, maintaining, and improving the risk controls, and for reporting and communicating the risk status and performance. The risk owner should also ensure that the controls are aligned with the risk appetite and tolerance of the enterprise, and that they support the achievement of the enterprise's objectives and value creation. References = Most Asked CRISC Exam Questions and Answers. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 244.

Explanation/Reference:
Explanation:
A risk event is been exploited so as to identify the opportunities for positive impacts. Exploit response is one of the strategies to negate risks or threats that appear in a project. This strategy may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized.
Exploiting a risk event provides opportunities for positive impact on a project. Assigning more talented resources to the project to reduce the time to completion is an example of exploit response.
Incorrect Answers:
A: To avoid a risk means to evade it altogether, eliminate the cause of the risk event, or change the project plan to protect the project objectives from the risk event.
B: Accepting is a risk response that is appropriate for positive or negative risk events. It does not pursue the risk, but documents the event and allows the risk to happen. Often acceptance is used for low probability and low impact risk events.
D: Enhancing is a positive risk response that aims to increase the probability and/or impact of the risk event.

Explanation/Reference:
Explanation:
The only two inputs for the risk response planning are the risk register and the risk management plan.
The plan risk response project management process aims to reduce the threats to the project objectives and to increase opportunities. It follows the perform qualitative risk analysis process and perform quantitative risk analysis process. Plan risk response process includes the risk response owner to take the job for each agreed-to and funded risk response. This process addresses the risks by their priorities, schedules the project management plan as required, and inserts resources and activities into the budget.
The inputs to the plan risk response process are as follows:
Risk register

Risk management plan

Incorrect Answers:
B: Kelly will not need the risk response plan until monitoring and controlling the project.
C: The results of risk analysis will help Kelly prioritize the risks, but this information will be recorded in the risk register.
D: Kelly needs the risk register and the risk management plan as the input. The power to assign risk responses is not necessarily needed by Kelly.