The first step in response to an identified risk is updating the risk profile to reflect the new exposure. This informs further actions such as treatment planning or tolerance reassessment.
Reference:CRISC Manual - Domain 1 & 2, Slide 94, 172

*A risk treatment plan is a document that describes the actions and resources needed to implement the chosen risk response strategy for each identified risk1. A risk response strategy is the way an organization decides to address a risk, such as avoiding, accepting, mitigating, or transferring it2.
*Sometimes, a risk treatment plan may not be completed on time due to various reasons, such as delays, resource constraints, technical issues, or changes in the risk environment. In such cases, the best approach is to implement compensating controls until the preferred action can be completed3.
*Compensating controls are alternative or additional controls that provide a similar level of assurance or protection as the original controls, when the latter are not feasible or sufficient3. Compensating controls can help to reduce the residual risk or maintain the risk within the acceptable level until the risk treatment plan is fully executed3.
*For example, if the risk treatment plan involves installing a firewall to protect the network from external threats, but the firewall is not available or compatible with the current system, a compensating control could be to use encryption, authentication, or monitoring tools to secure the network traffic until the firewall is installed3.
*Implementing compensating controls is better than the other options because it allows the organization to continue with the risk treatment plan while maintaining an adequate level of security and compliance. The other options are not advisable for the following reasons:
oReplacing the action owner with a more experienced individual (option A) may not solve the problem if the issue is not related to the action owner's competence or performance. Moreover, replacing the action owner may cause disruption, confusion, or conflict in the risk management process.
oChanging the risk response strategy of the relevant risk to risk avoidance (option C) may not be possible or desirable if the risk is associated with a critical or beneficial activity or process. Risk avoidance means eliminating the source of the risk or discontinuing the activity that causes the risk2. This may result in losing opportunities, benefits, or value for the organization.
oDeveloping additional key risk indicators (KRIs) until the preferred action can be completed (option D) may not be effective or efficient if the existing KRIs are already sufficient to monitor and measure the risk. KRIs are metrics or data points that provide early warning signals or information about the level or trend of a risk456. Developing additional KRIs may not reduce the risk or improve the risk treatment plan, but may increase the complexity and cost of the risk management process.
References =
*Key Risk Indicators: Examples & Definitions - SolveXia
*Key Risk Indicators: A Practical Guide | SafetyCulture
*Complete Guide to Key Risk Indicators - RiskOptics
*Risk Response Plan in Project Management: Key Strategies & Tips
*Risk response strategies: mitigation, transfer, avoidance, acceptance - Twproject: project management software,resource management, time tracking, planning, Gantt, kanban
*Risk Response Strategies: A Guide to Navigating Uncertainty - Teamly
*Compensating Controls | Audit and Compliance | Pathlock

The correct answer isAbecause if IT policies do not address AI, the greatest concern is thelack of direction for AI usage. Policy provides the organization's formal direction regarding acceptable use, roles, responsibilities, security requirements, risk handling, and compliance expectations. Without that direction, AI use may become inconsistent, unmanaged, and misaligned with business and risk objectives.
The other options are less significant as the primary concern:
* B. Increased reliance on shadow ITmay happen, but it is more a possible consequence than the main concern.
* C. Complexity of AI implementationis a project or technical issue, not the key governance gap.
* D. Lack of best practices for AI implementationis important, but organization-specific policy direction is more critical than generic best practices.
Exact Extracts supporting the answer:
* "Enterprise policies are the most influential factor in determining an enterprise's approach to risk management."
* "The FIRST policy that governs how information is to be protected from within the enterprise especially for a breakthrough technology is the data classification policy."
* "When many corporate IT standards are outdated the best course of action is to review the standards against current requirements and determine their adequacy."
* "During the initial stages of developing a risk management program it ' s crucial that the context and purpose of the program are defined." These extracts support that policy is the primary mechanism for setting direction and expectations. Therefore, the greatest concern is thelack of direction for AI usage.

According to the CRISC Review Manual (Digital Version), key risk indicator (KRI) thresholds are the most likely elements of a risk register to change as a result of change in management's risk appetite, as they reflect the acceptable levels of risk exposure for the organization. KRIthresholds are the values or ranges that trigger an alert or a response when the actual KRI values deviate from the expected or desired values. KRI thresholds help to:
Monitor and measure the current risk levels and performance of the IT assets and processes Identify and report any risk issues or incidents that may require attention or action Evaluate the effectiveness and efficiency of the risk response actions and controls Align the risk management activities and decisions with the organization's risk appetite and risk tolerance If the management's risk appetite changes, the KRI thresholds may need to be adjusted accordingly to ensure that the risk register reflects the current risk preferences and expectations of the organization.
References = CRISC Review Manual (Digital Version), Chapter 4: IT Risk Monitoring and Reporting, Section 4.1: IT Risk Monitoring, pp. 217-2181

Implementing an emergency change authorization process is the best control for an organization that allows programmers to change production systems in emergency situations, because it helps to ensure that the changes are justified, approved, documented, and tested before they are implemented, and that they are monitored and reviewed after they are implemented. An emergency change is a change that is required to resolve or prevent a critical issue or incident that may affect the availability, performance, or security of the production systems. A production system is a system that is used to support or enable the operational or business functions or processes of the organization. An emergency change authorization process is a process that defines the roles and responsibilities, criteria and procedures, and tools and techniques for managing and controlling the emergency changes. Implementing an emergency change authorization process is the best control, as it helps to minimize the risks and impacts of the emergency changes, and to maintain the integrity and reliability of the production systems. Periodically reviewing operator logs, limiting the number of super users, and reviewing the programmers' emergency change reports are all possible controls for an organization that allows programmers to change production systems in emergency situations, but they are not the best control, as they do not provide a comprehensive and consistent approach to the emergency change management. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.4.1, page 208