Disaster recovery plans are essential for ensuring the continuity and resilience of business operations in the event of a disruption or disaster. However, creating and maintaining separate disaster recovery plans for each business unit may not be cost-effective or efficient, as it may result in duplication, inconsistency, or gaps in the plans. Therefore, the best course of action would be to evaluate opportunities to combine disaster recovery plans across the business units, where possible and appropriate. This would help to achieve economies of scale, standardization, and alignment of the plans, as well as reduce complexity and costs. However, this does not mean that all disaster recovery plans should be identical or centralized, as different business units may have different risk profiles, recovery objectives, and requirements. Therefore, the combined disaster recovery plans should still be tailored and customized to suit the specific needs and characteristics of each business unit. References = ISACA CRISC Review Manual, 7th Edition, Chapter 2, Section 2.3.2, page 71.

The first step when addressing the situation of moving the payroll system to a SaaS application and complying with the new data privacy regulation is to understand the data flows. This means identifying where the data is collected, stored, processed, and transferred, and who has access to it. Understanding the data flows can help to determine the scope and impact of the regulation, as well as the potential risks and gaps in the current state. It can also help to identify the roles and responsibilities of the organization and the SaaS provider regarding data protection and compliance. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.3.1.2, p. 237-238

A risk management program is a set of processes, policies, and tools that enable an enterprise to identify, analyze, evaluate, treat, monitor, and communicate its risks. The maturity level of a risk management program indicates how well the program is integrated, standardized, and aligned with the enterprise's objectives, culture, and values. The best indication that an organization's risk management program has not reached the desired maturity level is large fluctuations in risk ratings between assessments. Risk ratings are the measures of the impact and likelihood of the risks, and they should be consistent and comparable across the enterprise and over time. Large fluctuations in risk ratings between assessments suggest that the risk management program is not stable, reliable, or effective, and that the risk identification and analysis methods are not robust, accurate, or transparent. The other options are not as indicative of the maturity level of the risk management program, as they involve different aspects or outcomes of the risk management program:
* Significant increases in risk mitigation budgets means that the enterprise is spending more resources on implementing risk responses, such as controls, policies, or procedures. This may indicate that the enterprise is facing more or higher risks, or that the risk responses are more costly or complex, but it does not necessarily reflect the maturity level of the risk management program, as it may also depend on the enterprise's risk appetite, tolerance, and strategy.
* A steady increase in the time to recover from incidents means that the enterprise is taking longer to restore its normal operations after a disruption or a loss. This may indicate that the enterprise is not prepared or resilient enough to deal with the incidents, or that the incidents are more frequent or severe, but it does not necessarily reflect the maturity level of the risk management program, as it may also depend on the nature and source of the incidents, or the availability and effectiveness of the recovery plans.
* A large number of control exceptions means that the enterprise is deviating from the established controls, policies, or procedures, either intentionally or unintentionally. This may indicate that the enterprise is not complying with the risk management program, or that the controls are not adequate or appropriate for the enterprise's needs, but it does not necessarily reflect the maturity level of the risk management program, as it may also depend on the reasons and justifications for the exceptions, or the approval and monitoring processes for the exceptions. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 1, Section 1.1.3.1, pp. 14-15.

The risk profile of an organization is a summary of the key risks that affect its objectives, operations, and performance. The risk profile can help senior management understand the current and potential exposure of the organization to various sources of uncertainty, and prioritize the risk response accordingly. An external security audit can reveal multiple findings related to control noncompliance, which indicate that the existing controls are not adequate, effective, or aligned with the organization's risk appetite. These findings can have a significant impact on the organization's risk profile, as they can increase the likelihood and/or impact of adverse events, such as data breaches, cyberattacks, regulatory fines, reputational damage, etc. Therefore, the most important information that the risk practitioner should communicate to senior management is the impact to the organization's risk profile, as it can help them make informed decisions about the risk response and allocation of resources. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.1: Risk Profile, p. 193-195.

The main reason for documenting the performance of controls is to provide accurate risk reporting. Risk reporting is a process that communicates and discloses the relevant and reliable information about the risks and their management to the stakeholders and decision makers. Risk reporting is an essential component of the risk management process, as it helps to monitor and evaluate the effectiveness and efficiency of the risk identification, assessment, response, and monitoring activities, as well as to support and inform the risk governance and oversight functions. Documenting the performance of controls is a technique that records and tracks the results and outcomes of the controls that are implemented to address the risks, such as the control objectives,