The correct answer isCbecause the most effective way to promote ethical decision-making in a global organization is to ensure that thecode of conduct is incorporated into organization-wide awareness training.
This makes ethical expectations clear, consistent, and actionable across all geographies, functions, and employee groups. Training helps translate ethical principles into day-to-day decisions and behaviors.
The other options are less effective:
* A. Embed risk averse culture within the organizationis too narrow because ethical decision-making is broader than simply being risk averse.
* B. Ensure ethics considerations are made in the hiring processis useful, but it is not sufficient by itself to drive ongoing ethical behavior.
* D. Require annual metrics related to ethics be reportedmay support oversight, but reporting does not influence decisions as directly as awareness and training.
Exact Extracts supporting the answer:
* "The most effective way to support adherence to an enterprise ' s code of ethics is by ensuring periodic training evaluation and attestation of employees."
* "The best proactive approach for practicing professional ethics within an enterprise is to provide ethics awareness training."
* "Developing and practicing ethical behavior within an enterprise contributes the most to building the risk culture."
* "The most significant benefit when stakeholders promote and follow professional ethics is that it increases risk management effectiveness within an enterprise." These extracts directly support that incorporating the code of conduct into organization-wide awareness training is the most effective approach.

The impact to affected stakeholdersis the most critical factor when considering risks tied to re-identification.
ISACA notes that risk is ultimately measured by how it affects stakeholders-including customers, partners, and regulators-particularly when personal data is involved.

The correct answer isDbecause the risk practitioner should firstidentify the business need for the unauthorized software. If employees are using unauthorized cloud software on personal devices for work-related tasks, this indicates there is likely an unmet business requirement. Before recommending controls or restrictions, the best course of action is to understand why the software is being used, what business process it supports, and what gap in approved solutions exists. This aligns with CRISC principles that risk assessment must consider business objectives and operational needs before selecting risk responses.
The other options are not the best first step:
* A. Evaluate the effectiveness of controls to prevent data lossmay be necessary later, but first the practitioner must understand the business driver behind the behavior.
* B. Develop a policy standard for conducting business using personal devicesmay eventually be appropriate, but not before the underlying need is identified.
* C. Recommend blocking downloads of unauthorized softwareis a control response, but it may disrupt business activities if the root business need is not understood.
Exact Extracts supporting the answer:
* "During the initial stages of developing a risk management program it ' s crucial that the context and purpose of the program are defined."
* "Strategic planning and business requirements should be the driving forces behind the IT plan."
* "When selecting a risk response technique the foremost consideration should be the enterprise goals and objectives."
* "To best support IT in fulfilling business requirements an internal control system or framework is essential."
* "An approach that best helps an enterprise achieve risk-based organizational objectives is to embed risk management activities into business processes." These extracts support that the practitioner should first understand the business context and requirements behind the unauthorized use. Only after identifying that business need can the organization choose the most appropriate policy, control, or risk response.

The primary driver for an organization on a multi-year cloud implementation to publish a cloud security policy is to establish minimum cloud security requirements, as they specify the standards and expectations for the protection of the data and systems in the cloud environment, and ensure the alignment and compliance of the cloud security strategy with the organizational objectives and regulations. The other options are not the primary drivers, as they are more related to the evaluation, enforcement, or education of the cloud security policy, respectively, rather than the establishment of the cloud security policy. References = CRISC Review Manual, 7th Edition, page 155.

The primary focus of an IT risk awareness program is to cultivate long-term behavioral change. An IT risk awareness program is a program that educates and informs the stakeholders, such as the employees, managers, customers, or partners, about the IT risks and the IT risk management activities. An IT risk awareness program helps to increase the knowledge and understanding of the IT risks and the IT risk management objectives, strategies, and processes, and to promote the participation and collaboration of the stakeholders in the IT risk management activities. The primary focus of an IT risk awareness program is to cultivate long-term behavioral change, which is the change in the attitudes, beliefs, values, and actions of the stakeholders regarding the IT risks and the IT risk management activities. Cultivating long-term behavioral change helps to create and sustain a risk-aware culture, which is a culture that recognizes, respects, and supports the IT risk management activities, and that encourages the stakeholders to take responsibility and ownership of the IT risks and the IT risk management activities. Cultivating long-term behavioral change also helps to improve the effectiveness and efficiency of the IT risk management activities, and to align the IT risk management activities with the business goals and values. Ensuring compliance with the organization's internal policies, communicating IT risk policy to the participants, and demonstrating regulatory compliance are not the primary focus of an IT risk awareness program, as they are either the benefits or the objectives of the IT risk awareness program, and they do not address the primary need of changing the behavior of the stakeholders. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 36.