According to the CRISC Review Manual, the primary objective of providing an aggregated view of IT risk to business management is to enable consistent data on risk to be obtained, because it helps to ensure that the risk information is comparable, reliable, and accurate across the organization. An aggregated view of IT risk is a consolidated and comprehensive representation of the IT risk exposure and impact at the enterprise level, based on the risk identification, analysis, and evaluation processes. Providing an aggregated view of IT risk to business management allows them to understand the overall IT risk profile and performance, and to make informed decisions about the risk management strategies and priorities. The other options are not the primary objective of providing an aggregated view of IT risk, as they are related to other benefits or outcomes of the risk aggregation process. Allowing for proper review of risk tolerance is the objective of establishing the risk context, which defines the scope and boundaries of the risk management activities. Identifying dependencies for reporting risk is the outcome of the risk aggregation process, as it provides a clear and consistent structure and format for the risk communication and reporting. Providing consistent and clear terminology is the objective of developing the risk taxonomy, which is the system of classification and categorization of risks based on common characteristics and attributes. References = CRISC Review Manual, 7th Edition, Chapter 2, Section 2.1.2, page 69.

A consolidated view into the organization's risk profile is a comprehensive and integrated representation of the risks that may affect the organization's objectives, performance, and value creation12.
The most helpful material to provide a consolidated view into the organization's risk profile is the IT risk register, which is a document that records and tracks the IT-related risks, their sources, impacts, likelihoods, responses, owners, and statuses within the organization34.
The IT risk register is the most helpful material because it provides a complete and consistent overview of the IT risk landscape, and enables the identification, analysis, evaluation, treatment, monitoring, and communication of IT risks across the organization34.
The IT risk register is also the most helpful material because it supports the project prioritization and resource allocation decisions, by highlighting the most significant and relevant IT risks, and by showing the alignment of the IT risk responses with the organization's risk appetite, strategy, and objectives34.
The other options are not the most helpful materials, but rather possible inputs or outputs of the IT risk register. For example:
A list of key risk indicators (KRIs) is a set of metrics that measure the occurrence or status of IT risks, and provide timely and relevant information and feedback to the organization56. However, a list of KRIs is not the most helpful material because it does not provide a comprehensive and integrated view of the IT risk profile, but rather a snapshot or a trend of selected IT risks56.
Internal audit reports are documents that present the findings and recommendations of the internal audit function, which evaluates the adequacy and effectiveness of the IT risk management and control processes within the organization78. However, internal audit reports are not the most helpful material because they do not provide a comprehensive and integrated view of the IT risk profile, but rather a periodic and independent assessment of specific IT risk areas78.
A list of approved projects is a document that records and tracks the IT projects that have been authorized and funded by the organization, and their objectives, scope, schedule, budget, and status . However, a list of approved projects is not the most helpful material because it does not provide a comprehensive and integrated view of the IT risk profile, but rather a summary of the IT project portfolio . References =
1: Risk IT Framework, ISACA, 2009
2: IT Risk Management Framework, University of Toronto, 2017
3: IT Risk Register Template, ISACA, 2019
4: IT Risk Register Toolkit, ISACA, 2019
5: KPIs for Security Operations & Incident Response, SecurityScorecard Blog, June 7, 2021
6: Key Performance Indicators (KPIs) for Security Operations and Incident Response, DFLabs White Paper,
2018
7: IT Audit and Assurance Standards, ISACA, 2014
8: IT Audit and Assurance Guidelines, ISACA, 2014
IT Project Management Framework, University of Toronto, 2017
IT Project Management Best Practices, ISACA Journal, Volume 1, 2018

Obtaining a holistic view of IT strategy risk is the primary benefit of conducting a risk workshop using a top- down approach instead of a bottom-up approach, because it helps to identify and assess the risks that may affect the alignment and integration of IT with the organization's objectives and strategy. A risk workshop is a collaborative and interactive method of conducting a risk assessment, where the risk practitioner facilitates a group discussion with the relevant stakeholders to identify, analyze, and evaluate the risks and their controls.
A top-down approach is a method of conducting a risk workshop that starts from the high-level or strategic perspective, and then drills down to the lower-level or operational details. A bottom-up approach is a method of conducting a risk workshop that starts from the low-level or operational details, and then aggregates them to the higher-level or strategic perspective. A top-down approach can offer a holistic view of IT strategy risk, as it helps to understand the big picture and the interrelationships of the risks and their impacts across the organization. A bottom-up approach can offer a detailed view of specific project or process risk, as it helps to capture the granular and technical aspects of the risks and their controls. Therefore, obtaining a holistic view of IT strategy risk is the primary benefit of using a top-down approach, as it supports the strategic alignment and integration of IT with the organization. Identifying specific project risk, understanding risk associated with complex processes, and incorporating subject matter expertise are all possible benefits of conducting a risk workshop, but they are not the primary benefit of using a top-down approach, as they are more suitable for a bottom-up approach. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.2, page 87

Risk tolerance is the best term to describe the situation where an organization has agreed to a 99% availability for its online services and will not accept availability that falls below 98.5%. Risk tolerance is the amount and type of risk that an organization is willing to accept in order to achieve its objectives. Risk tolerance defines the acceptable variation in outcomes related to specific performance measures, such as availability, reliability, or security. Risk tolerance is usually expressed as a range, such as 99% +/- 0.5%. Risk mitigation, risk evaluation, and risk appetite are not the correct terms to describe this situation, because they refer to different aspects of risk management, such as reducing, assessing, or pursuing risk, respectively. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.2.1, page 1-8.

Organizational objectives should be the primary input to determine risk tolerance, as they define the desired outcomes and performance of the organization, and guide the selection of the acceptable level of risk that the organization is willing to take to achieve those objectives. Regulatory requirements, annual loss expectancy (ALE), and risk management costs are not the primary inputs, as they are more related to the external or internal constraints or factors that affect the risk tolerance, rather than the drivers or determinants of the risk tolerance. References = CRISC Review Manual, 7th Edition, page 109.