Validating the risk scenarios is the most important time to involve business stakeholders, as they can provide feedback on the relevance, completeness, and accuracy of the scenarios. They can also help to ensure that the scenarios are aligned with the business objectives, context, and risk appetite. By involving business stakeholders in the validation process, the risk practitioner can increase the credibility and acceptance of the risk scenarios.
Updating the risk register, documenting the risk scenarios, and identifying risk mitigation controls are all important steps in the risk scenario development process, but they are not the most important time to involve business stakeholders. These steps can be performed by the risk practitioner with input from other sources, such as subject matter experts, historical data, industry standards, etc. References = CRISC Review Manual,
7th Edition, ISACA, 2020, page 47-481

Inherent risk is the most likely to increase as a result of the new initiative, because it is the risk that exists before any controls or mitigating factors are applied. Inherent risk reflects the natural or raw level of exposure that the organization faces from a given risk source or scenario. Accepting credit card payments from customers via the corporate website introduces new sources and types of risk, such as fraud, theft, data breach, or non-compliance, that increase the inherent risk level of the organization. Risk tolerance, risk appetite, and residual risk are all related to the risk management process, but they are not the most likely to increase as a result of the new initiative, as they depend on the organization's risk strategy, objectives, and controls. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.1, page 51

The risk owner is the person or entity that has the accountability and authority to manage a risk. The risk owner should be accountable for monitoring the control environment to ensure controls are effective, as they are responsible for implementing, maintaining, and improving the risk controls, and for reporting and communicating the risk status and performance. The risk owner should also ensure that the controls are aligned with the risk appetite and tolerance of the enterprise, and that they support the achievement of the enterprise's objectives and value creation. References = Most Asked CRISC Exam Questions and Answers. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 244.

The GREATEST concern associated with business end users developing their own applications on end user spreadsheets and database programs is:
B: Controls are not applied to the applications.
When end users create their own applications, there is often a lack of formal controls that would typically be applied in a structured development environment. This can lead to issues with data integrity, security vulnerabilities, and non-compliance with organizational policies and standards.

The greatest concern for a risk practitioner when reviewing the findings of a security awareness program assessment is that the program uses non-customized training modules. Non-customized training modules are generic and may not address the specific security needs, issues, and challenges of the organization. They may also fail to engage and motivate the employees to follow the security policies and procedures, and to enhance their security knowledge and skills. The program not decreasing threat counts, not considering business impact, or being significantly revised are other possible findings, but they are not as concerning as the program using non-customized training modules. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 7; CRISC Review Manual, 6th Edition, page 202.