A post-implementation review (PIR) is a process to evaluate whether the objectives of the project were met and whether the project delivered the expected benefits and outcomes1. The primary objective of a risk practitioner performing a PIR of an IT risk mitigation project is to verify that the risk level has been lowered as a result of the project implementation2. This can be done by comparing the actual risk level with the expected risk level, assessing the effectiveness and efficiency of the risk mitigation controls, and identifying any residual or emerging risks3. Documenting project lessons learned, validating the project completion, and confirming the project budget are important aspects of a PIR, but they are not the primary objective for a risk practitioner, as they do not directly measure the impact of the project on the risk level4. References = Risk and Information Systems Control Study Manual, Chapter 5: Risk Response and Mitigation, Section 5.4: Post- Implementation Review, pp. 239-241.

Key risk indicators (KRIs) are metrics that provide information on the level of exposure to a given operational risk1. KRIs have upper and lower acceptable risk limits (warning thresholds) that trigger actions when exceeded2. These thresholds are based on the organization's risk appetite or tolerance, which is the amount and type of risk that the organization is willing to accept in pursuit of its objectives3. Therefore, changes in risk appetite or tolerance would prompt changes in KRI thresholds, as the organization would need to adjust its risk monitoring and response accordingly. The other options are not the primary factors that would prompt changes in KRI thresholds, although they may have some influence on the risk management process.
References = Risk IT Framework; IT Risk Resources; ISACA Risk Starter Kit; Key Risk Indicators; Key Risk Indicators: A Practical Guide

The control owner is the person who is accountable for ensuring that a control is designed, implemented, and operated effectively to mitigate risk. The control owner is also responsible for monitoring the performance of the control and reporting any issues or deficiencies. The risk manager is the person who oversees the risk management process and ensures that risks are identified, assessed, and treated appropriately. The control operator is the person who executes the control activities on a day-to-day basis. The risk treatment owner is the person who is accountable for implementing the risk response strategy and ensuring that the residual risk is within the acceptable level. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.2.1, p. 181.

The greatest risk associated with the transition of a sensitive data backup solution from on-premise to a cloud service provider is inadequate data encryption. Data encryption is a key security measure that protects the confidentiality and integrity of data, especially when it is stored or transmitted over a network. If the data encryption is inadequate, the data backup solution may be vulnerable to unauthorized access, modification, or disclosure by malicious actors or third parties. This could result in data breaches, regulatory fines, reputational damage, or legal liabilities for the enterprise. More complex test restores, inadequate service level agreement (SLA) with the provider, and more complex incident response procedures are also potential risks associated with the transition, but they are not as great as inadequate data encryption. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.2.1.1, page 245.

The best way to measure the effectiveness of the subsidiary's IT systems controls is to review metrics and key performance indicators (KPIs), as they provide quantitative and qualitative measures of the performance and outcomes of the IT systems and processes, and how well they meet the predefined standards and expectations. Metrics and KPIs can help to evaluate the efficiency, reliability, security, and quality of the IT systems and controls, and to identify any gaps, weaknesses, or issues that need to be addressed. Metrics and KPIs can also help to compare and benchmark the subsidiary's IT systems and controls with those of the parent organization or other similar entities. The other options are not the best ways to measure the effectiveness of the subsidiary's IT systems controls, although they may be useful or complementary methods.
Implementing IT systems in alignment with business objectives is a good practice, but it does not measure the effectiveness of the IT systems controls, as it focuses on the alignment and integration of the IT systems with the business strategy and goals. Reviewing design documentation of IT systems can provide some information on the specifications and requirements of the IT systems, but it does not measure the effectiveness of the IT systems controls, as it does not reflect the actual implementation and operation of the IT systems. Evaluating compliance with legal and regulatory requirements can ensure that the subsidiary's IT systems and controls meet the minimum standards and obligations of the foreign country, but it does not measure the effectiveness of the IT systems controls, as it does not consider the performance and outcomes of the IT systems and processes. References = Risk and Information Systems Control Study Manual, Chapter 5: Risk and Control Monitoring and Reporting, page 187.