When likelihood is unknown, range-based estimates from subject-matter experts provideinformed and realistic insights into potential risk exposure. This approach helps approximate the inherent risk based on experience and expertise, supporting effective decision-making.

The most important element of a successful risk awareness training program is customizing content for the audience, because this ensures that the training is relevant, engaging, and effective for the learners.
Customizing content for the audience means tailoring the training materials and methods to suit the specific needs, preferences, and characteristics of the target group, such as their roles, responsibilities, knowledge, skills, attitudes, and learning styles. Customizing content for the audience can help to achieve the following benefits:
Increase the motivation and interest of the learners, as they can see the value and applicability of the training to their work and goals.
Enhance the comprehension and retention of the learners, as they can relate the training content to their prior knowledge and experience, and use examples and scenarios that are familiar and realistic to them.
Improve the transfer and application of the learners, as they can practice and apply the training content to their actual work situations and challenges, and receive feedback and support that are relevant and useful to them. References = Implementing risk management training and awareness (part 1) 1

The greatest concern for an IT risk practitioner when an employee transfers to another department is that unnecessary access permissions have not been removed. Unnecessary access permissions are the access rights or privileges that are no longer needed, relevant, or appropriate for the employee's new role or responsibility.
If these access permissions are not removed, they may pose a significant security risk, as the employee may be able to access, modify, or delete sensitive or critical data and systems that are not related to their current function. This may result in data leakage, fraud, sabotage, or compliance violations. The other options are not as concerning as unnecessary access permissions, as they are related to the organizational, operational, or knowledge aspects of the employee transfer, not the security or risk aspects of the employee transfer. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Response, Section 3.3: IT Risk Response Implementation, page 145.

IT disaster recovery point objectives (RPOs) should be based on the:
B: maximum tolerable loss of data.
RPOs are determined by how much data loss an organization can withstand in the event of a disaster. It's a measure of the maximum age of files that an organization must recover from backup storage for normal operations to resume after a disaster. Therefore, RPOs are directly related to the maximum tolerable loss of data.

Meeting defined RTOs and RPOs indicates that the DR plan can achieve its intended goals under real conditions. This metric directly reflects the effectiveness and reliability of the program.
Reference:CRISC Manual - Domain 4, Slide 452, 554