Conducting a root cause analysis is the best course of action for an IT business owner following an unexpected increase in emergency changes, as it helps to identify and address the underlying cause(s) of the problem and prevent it from recurring in the future. A root cause analysis is a systematic process of finding and resolving the fundamental factors that contribute to a specific issue or event. A root cause analysis can help to improve the quality and reliability of the IT services and processes, reduce the costs and risks associated with emergency changes, and enhance the customer satisfaction and trust.
The other options are not the best courses of action for an IT business owner following an unexpected increase in emergency changes. Evaluating the impact to control objectives is an important step to assess the potential consequences of the emergency changes on the IT governance and risk management, but it does not provide a solution or mitigation strategy for the problem. Validating the adequacy of current processes is a good practice to ensure that the IT processes are aligned with the business needs and objectives, but it does not address the specific cause(s) of the emergency changes. Reconfiguring the IT infrastructure is a possible action to implement the emergency changes, but it does not prevent the occurrence or recurrence of the problem.
References = IT Business Owner's Best Course of Action Following Unexpected Increase ..., ITIL Change Types: Standard vs Normal vs Emergency - Freshworks, Emergency Change Management: Please Stop The Drama

Section: Volume D
Explanation/Reference:

The most relevant information to include in a risk management strategy is the organizational goals, because they provide the direction and purpose for the risk management activities. A risk management strategy is a document that outlines the objectives, scope, approach, roles, and responsibilities for managing risks in an organization. A risk management strategy should align with the organizational goals, which are the desired outcomes or results that the organization wants to achieve. The organizational goals should be specific, measurable, achievable, relevant, and time-bound (SMART), and they should reflect the organization's vision, mission, values, and strategy. By including the organizational goals in the risk management strategy, the risk practitioner can ensure that the risk management process supports and enables the achievement of the organizational goals. The risk practitioner can also use the organizational goals as a basis for identifying, assessing, prioritizing, and responding to the risks that may affect the organization's performance and success.
The risk practitioner can also monitor and measure the progress and effectiveness of the risk management process by comparing the actual results with the expected results based on the organizational goals. Therefore, the organizational goals are the most relevant information to include in a risk management strategy, as they provide the foundation and framework for the risk management process. References = Risk and Information Systems Control Study Manual, Chapter 1: IT Risk Identification, Section 1.1: IT Risk Management Strategy, pp. 3-61

According to the CRISC Review Manual, the primary objective of providing an aggregated view of IT risk to business management is to enable consistent data on risk to be obtained, because it helps to ensure that the risk information is comparable, reliable, and accurate across the organization. An aggregated view of IT risk is a consolidated and comprehensive representation of the IT risk exposure and impact at the enterprise level, based on the risk identification, analysis, and evaluation processes. Providing an aggregated view of IT risk to business management allows them to understand the overall IT risk profile and performance, and to make informed decisions about the risk management strategies and priorities. The other options are not the primary objective of providing an aggregated view of IT risk, as they are related to other benefits or outcomes of the risk aggregation process. Allowing for proper review of risk tolerance is the objective of establishing the risk context, which defines the scope and boundaries of the risk management activities. Identifying dependencies for reporting risk is the outcome of the risk aggregation process, as it provides a clear and consistent structure and format for the risk communication and reporting. Providing consistent and clear terminology is the objective of developing the risk taxonomy, which is the system of classification and categorization of risks based on common characteristics and attributes. References = CRISC Review Manual, 7th Edition, Chapter 2, Section 2.1.2, page 69.