Explanation/Reference:
Explanation:
Business process owners are the individuals responsible for identifying process requirements, approving process design and managing process performance. In general, a business process owner must be at an appropriately high level in the enterprise and have authority to commit resources to process-specific risk management activities.
Incorrect Answers:
B: Risk owner for each risk should be the person who has the most influence over its outcome. Selecting the risk owner thus usually involves considering the source of risk and identifying the person who is best placed to understand and implement what needs to be done.
C: Chief financial officer is the most senior official of the enterprise who is accountable for financial planning, record keeping, investor relations and financial risks.
D: Chief information officer is the most senior official of the enterprise who is accountable for IT advocacy; aligning IT and business strategies; and planning, resourcing and managing the delivery of IT services and information and the deployment of associated human resources.

D, and B are incorrect. Cost of software is not been counted because it can be restored
from the back-up media. On the other hand' Ale for all risk related to the server does not represent
the server's value. Lastly, the original cost may be significantly different from the current cost and,
therefore, not relevant to this.

Configuration updates are changes made to the settings, parameters, or components of an IT system or network. Configuration updates can affect the functionality, performance, security, and reliability of the system or network. Therefore, configuration updates should follow formal change control, which is a process that ensures that changes are authorized, documented, tested, and implemented in a controlled manner. Formal change control can help prevent errors, conflicts, disruptions, and vulnerabilities that may arise from configuration updates. Configuration updates that do not follow formal change control should be of greatest concern to a risk practitioner when determining the effectiveness of IT controls, as they can introduce new risks or compromise existing controls. References = Risk and Information Systems Control Study Manual, Chapter 3: Risk Response and Mitigation, Section 3.5: Control Monitoring and Reporting, p. 161-162.

KRIs and KCIs are both metrics that measure and monitor the risk and control environment of an enterprise.
KRIs are indicators that reflect the level and trend of risk exposure, and help to identify potential risk events or issues. KCIs are indicators that reflect the performance and effectiveness of the risk controls, and help to ensure that the controls are operating as intended and mitigating the risk. Both KRIs and KCIs provide insight to potential changes in the level of risk, as they can signal the need for risk response actions, such as enhancing, modifying, or implementing new controls, or adjusting the risk strategy and objectives. References
= Most Asked CRISC Exam Questions and Answers. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 240.