The best metric to verify adherence to the policy that requires critical security patches to be deployed in production within three weeks of patch availability is the maximum time gap between patch availability and deployment, as it measures the longest duration that the organization takes to apply the patches, and ensures that it does not exceed the policy limit. The other options are not the best metrics, as they may not reflect the actual or optimal compliance with the policy, or may not be relevant or measurable for the policy, respectively. References = CRISC Review Manual, 7th Edition, page 110.

According to the CRISC Review Manual1, vendor risk mitigation action items are the specific tasks and activities that are assigned to the vendors or the organization to address the identified risks and implement the risk responses. The percentage of vendor risk mitigation action items completed on time is the best key performance indicator (KPI) to measure the effectiveness of a vendor risk management program, as it helps to evaluate the timeliness and quality of the vendor performance, the alignment of the vendor activities with the organization's risk appetite and objectives, and the achievement of the expected outcomes and benefits of the risk responses. The percentage of vendor risk mitigation action items completed on time also helps to identify and resolve any issues or gaps in the vendor risk management process, and to improve the vendor relationship and communication. References = CRISC Review Manual1, page 230.

Artificial intelligence (AI) is a branch of computer science that aims to create machines or systems that can perform tasks that normally require human intelligence, such as learning, reasoning, decision making, etc.
An organization that is considering adopting AI should be aware of the potential risks and challenges that may arise from using AI, such as ethical, legal, social, technical, operational, or security issues.
The most important course of action for the risk practitioner is to identify applicable risk scenarios. This means that the risk practitioner should analyze the context and objectives of the AI adoption, the stakeholders and their expectations, the data and information sources and quality, the AI models and algorithms and their reliability, the AI outputs and outcomes and their impact, and the AI governance and oversight mechanisms and their effectiveness.
Identifying applicable risk scenarios helps to assess the likelihood and impact of the risks, prioritize the risks, design and implement appropriate risk responses, monitor and evaluate the risk performance, and report and communicate the risk status and issues.
The other options are not the most important courses of action for the risk practitioner. They are either secondary or not essential for AI risk management.
The references for this answer are:
Risk IT Framework, page 24
Information Technology & Security, page 18
Risk Scenarios Starter Pack, page 16

Administrative controls are the best controls to be strengthened by a clear organizational code of ethics, because they are the policies, procedures, standards, and guidelines that define the expected behavior and conduct of the employees and management. A code of ethics is an example of an administrative control that sets the ethical principles and values of the organization and helps to prevent or deter unethical or illegal actions. The other options are not the best controls to be strengthened by a clear organizational code of ethics, because they are not directly related to the ethical culture or governance of the organization. Detective controls are the controls that monitor and report the occurrence of unwanted events or incidents. Technical controls are the controls that use hardware, software, or network devices to protect the information systems and data. Preventive controls are the controls that prevent or avoid the occurrence of unwanted events or incidents. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers

The greatest risk to change control in business application development over the complete life cycle is the introduction of requirements that have not been approved. Requirements are the specifications or expectations of the business users or stakeholders for the application, such as the features, functions, or performance1. Change control is the process of identifying, evaluating, approving, and implementing changes to the application, such as the design, code, or configuration2. By introducing requirements that have not been approved, the organization can face significant risks, such as:
* Scope creep, which is the uncontrolled or unauthorized expansion of the project scope, and can result in increased costs, delays, or errors3.
* Quality issues, which can affect the reliability, usability, or security of the application, and can lead to defects, failures, or breaches4.
* Stakeholder dissatisfaction, which can arise from the mismatch or inconsistency between the delivered application and the expected application, and can cause complaints, disputes, or litigation5.
The other options are not the greatest risk to change control, because:
* Emphasis on multiple application testing cycles is not a risk, but rather a benefit or a best practice for change control, as it can help to ensure that the application meets the requirements and standards, and that the changes are effective and efficient.
* Lack of an integrated development environment (IDE) tool is a challenge, but not a risk, for change control, as it can affect the productivity, collaboration, or integration of the developers, and can cause difficulties or inefficiencies in the development process. However, it does not directly affect the requirements or the quality of the application, and it can be overcome by using other tools or methods.
* Bypassing quality requirements before go-live is a risk, but not the greatest risk, for change control, as it can compromise the quality or performance of the application, and can expose the organization to errors, failures, or breaches. However, it is less likely or frequent than introducing requirements that have not been approved, and it can be detected or prevented by using quality assurance or quality control techniques.
References
* Requirements - CIO Wiki
* Change Control - CIO Wiki
* Scope Creep - CIO Wiki
* Quality - CIO Wiki
* Stakeholder Management - CIO Wiki
* [Software Testing - CIO Wiki]
* [Integrated Development Environment (IDE) - CIO Wiki]
* [Quality Requirements - CIO Wiki]
* [Software Development Life Cycle - CIO Wiki]