Risk appetite is the broad-based amount of risk that an organization is willing to accept in its activities. Risk appetite reflects the level of risk that the organization is prepared to take to achieve its strategic goals, and provides guidance and boundaries for the risk management activities and decisions. The best way to balance the costs and benefits of managing IT risk is to prioritize and address risk in line with risk appetite, which means that the organization should identify, assess, treat, monitor, and communicate the risks that are within or exceed the risk appetite, and allocate the resources and efforts accordingly. By doing so, the organization can optimize its risk-return trade-off, align its risk exposure with its strategic objectives, and enhance its risk culture and performance. References = 5

Business process re-engineering is the radical redesign of a business process to achieve significant improvements in performance, quality, cost, or customer satisfaction. Business process re-engineering can introduce new or modified risks to the organization, as well as affect the existing controls and responses.
Therefore, the best way to help ensure risk will be managed properly after a business process has been re-engineered is to reassess the control effectiveness of the process, meaning that the organization should evaluate whether the controls are still adequate, appropriate, and functioning as intended to mitigate the risks.
Reassessing the control effectiveness can help to identify any gaps or weaknesses in the control environment, as well as to implement any necessary changes or improvements to the controls. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.2.2, p. 229-230

Senior management's role in the RACI model when tasked with reviewing monthly status reports provided by risk owners is accountable, as it means that they have the ultimate authority and responsibility to approve or reject the risk management decisions and actions, and to oversee the risk management performance and outcomes. The other options are not the correct roles, as they imply different levels or types of involvement or participation in the risk management process, such as being informed, responsible, or consulted, respectively. References = CRISC Review Manual, 7th Edition, page 101.

Code review could BEST detect an in-house developer inserting malicious functions into a web-based application, because it is a process that involves examining and verifying the source code of the application for any errors, vulnerabilities, or malicious functions. Code review can help to identify and remove any unauthorized or harmful code that the developer may have inserted, either intentionally or unintentionally, and to ensure that the application meets the quality and security standards and requirements. The other options are not as effective as code review, because:
Option A: Segregation of duties is a control that involves separating the roles and responsibilities of the developer from those of the tester, the approver, and the deployer, to prevent any conflict of interest or misuse of authority. Segregation of duties can help to reduce the risk of the developer inserting malicious functions into the web-based application, but it does not detect them.
Option C: Change management is a process that involves controlling and documenting any changes to the web-based application, such as new features, enhancements, or bug fixes, to ensure that they are authorized, tested, and approved. Change management can help to track and monitor the changes that the developer may have made to the web-based application, but it does not detect the malicious functions.
Option D: Audit modules are components that are embedded in the web-based application to record and report the activities and transactions that occur within the application, such as user login, data input, or data output.
Audit modules can help to audit and review the performance and functionality of the web-based application, but they do not detect the malicious functions. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 214.