Capacity management is crucial when transitioning employees to remote work during a crisis. It involves ensuring that the IT infrastructure can handle increased loads and that resources are available to support remote operations effectively.

Reporting risk assessment results to senior management is an essential part of risk communication, which is the process of sharing relevant and timely information about the risk exposure and risk management activities with the stakeholders. The most important benefit of reporting risk assessment results to senior management is to facilitate risk-aware decision making, which is the process of incorporating the risk information and analysis into the strategic and operational decisions of the organization. By reporting the risk assessment results, the risk practitioner can provide senior management with the insight and understanding of the current and potential risks, their likelihood and impact, their interrelationships and dependencies, and their alignment with the risk appetite and tolerance. This can help senior management to prioritize the risks, allocate the resources, select the risk responses, monitor the risk performance, and evaluate the risk outcomes. References = CRISC Review Manual, 7th Edition, page 105.

Control effectiveness is best determined throughcontrol testing, which evaluates whether a control operates as intended over time. It includes functional and operational validation under real-world conditions, unlike documentation or design, which only indicate intent.
Reference:CRISC Manual - Domain 4, Slide 388-390

A risk response action plan is a document that outlines the specific tasks, resources, timelines, and deliverables for the risk responses, which are the actions or strategies that are taken to address the risks that may affect the organization's objectives, performance, or value creation12.
The most useful tool when measuring the progress of a risk response action plan is an up-to-date risk register, which is a document that records and tracks the significant risks that the organization faces, and the responses and actions that are taken to address them34.
An up-to-date risk register is the most useful tool because it provides a comprehensive and consistent view of the risk landscape, and the status and performance of the risk responses and actions34.
An up-to-date risk register is also the most useful tool because it enables the monitoring and evaluation of the risk response action plan, and the identification and communication of any issues or gaps that need to be resolved or improved34.
The other options are not the most useful tools, but rather possible metrics or indicators that may be used to measure the progress of a risk response action plan. For example:
Percentage of mitigated risk scenarios is a metric that measures the proportion of risk scenarios that have been reduced or eliminated by the risk responses and actions56. However, this metric is not the most useful tool because it does not provide a comprehensive and consistent view of the risk landscape, and it may not capture the residual or emerging risks that may arise after the risk responses and actions56.
Annual loss expectancy (ALE) changes is a metric that measures the difference between the expected annual losses before and after the risk responses and actions78. However, this metric is not the most useful tool because it does not provide a comprehensive and consistent view of the risk landscape, and it may not reflect the qualitative or intangible impacts of the risks or the risk responses and actions78.
Resource expenditure against budget is a metric that measures the amount of resources and funds that have been spent or allocated for the risk responses and actions, compared to the planned or estimated budget .
However, this metric is not the most useful tool because it does not provide acomprehensive and consistent view of the risk landscape, and it may not indicate the effectiveness or efficiency of the risk responses and actions . References =
1: Risk Response Plan in Project Management: Key Strategies & Tips1
2: How to Create the Ultimate Risk Response Plan | Wrike2
3: Risk Register Template and Examples | Prioritize and Manage Risk3
4: Risk Register Examples for Cybersecurity Leaders4
5: Risk Scenarios Toolkit, ISACA, 2019
6: Risk Scenarios Starter Pack, ISACA, 2019
7: Annualized Loss Expectancy (ALE) - Definition and Examples5
8: Annualized Loss Expectancy (ALE) Calculator6
Project Budgeting: How to Estimate Costs and Manage Budgets7
Project Budget Template - Download Free Excel Template8