To determine if a risk is under-controlled, the risk practitioner will need to understand the risk tolerance. Risk tolerance is the acceptable or allowable level of variation or deviation from the expected or desired outcomes or objectives. Risk tolerance reflects the amount and type of risk that the organization is willing and able to take. A risk is under-controlled when the risk exposure exceeds the risk tolerance, meaning that the organization is taking on more risk than it can handle or afford. Therefore, the risk practitioner will need to understand the risk tolerance to compare it with the risk exposure and identify the gap or difference. The other options are not as relevant as understanding the risk tolerance, as they are related to the monitoring, identification, or determination of the risk or the IT performance, not the comparison or evaluation of the risk. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.4: IT Risk Response, page 87.

Quantum computing threatens outdated algorithms and key lengths. The biggest concern is stale encryption standards-they directly relate to cryptographic resilience. ISACA materials underscore that encryption evaluation is foundational in emerging-threat risk assessments.

A risk mitigation action plan is a document that specifies the actions to be taken to address the identified risks, the resources required, the timelines, the owners, and the expected outcomes. The risk owner is the person who has the authority and accountability to manage the risk and its response. The risk practitioner is the person who supports the risk owner in the risk management process. The best course of action for the risk practitioner when the manager of a risk mitigation action plan is replaced and a new control is implemented is to communicate the decision to the risk owner for approval. This will ensure that the risk owner is aware of the change, agrees with the new control, and approves the modification of the action plan. The other options are not the best course of action, as they may not involve the risk owner, who is ultimately responsible for the risk and its response. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter
3, Section 3.1.1.1, pp. 95-96.

A risk map is the best method to ensure that the risk is measurable against the organization's risk appetite, as it is a graphical tool that displays the level and priority of risks based on their likelihood and impact, as well as other factors such as velocity, persistence, and urgency. A risk map can help to compare and communicate the risk levels across different business units, processes, and projects, and to align them with the organization's risk appetite and tolerance. A risk map can also help to identify the gaps and overlaps in risk management, and to support the decision making and resource allocation for risk response. A cause-and-effect diagram is a tool that helps to identify and analyze the root causes and consequences of a risk or a problem, but it does not measure the risk against the organization's risk appetite. A maturity model is a tool that helps to assess and improve the capability and performance of a process or a function, but it does not measure the risk against the organization's risk appetite. A technology strategy plan is a document that outlines the vision, goals, and objectives of the organization's use of information and technology, but it does not measure the risk against the organization's risk appetite. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Assessment, page 97.

Shadow systems are IT systems, solutions, devices, or technologies used within an organization without the knowledge and approval of the corporate IT department1. They are often the result of employees trying to address specific functionality gaps in the organization's official systems, such as the ERP system. However, shadow systems can pose significant risks to the organization, such as:
Data security and privacy breaches, as shadow systems may not comply with the organization's security policies and standards, or may expose sensitive data to unauthorized parties2.
Data quality and integrity issues, as shadow systems may not synchronize or integrate with the organization's official systems, or may create data inconsistencies or redundancies3.
Compliance and regulatory violations, as shadow systems may not adhere to the organization's legal or contractual obligations, or may create audit or reporting challenges4.
Cost and resource inefficiencies, as shadow systems may duplicate or conflict with the organization's official systems, or may consume more IT resources than necessary5.
The best way to reduce the risk associated with shadow systems is to implement an enterprise architecture (EA), which is a comprehensive framework that defines the structure, processes, principles, and standards of the organization's IT environment6. By implementing an EA, the organization can:
Align the IT systems with the organization's goals and strategy, and ensure that they support the business needs and requirements6.
Establish a governance structure and process for IT decision making, and ensure that all IT systems are approved, monitored, and controlled by the IT department7.
Enhance the communication and collaboration between the IT department and the business units, and ensure that the IT systems meet the expectations and preferences of the end users5.
Optimize the performance and efficiency of the IT systems, and ensure that they are scalable, flexible, and interoperable6.
References =
Shadow IT: What Are the Risks and How Can You Mitigate Them? - Ekran System How to Reduce Risks of Shadow IT by Applying Governance to Public Clouds - BMC Software | Blogs What is shadow IT? - Article | SailPoint The Risks of Shadow IT and How to Avoid Them | SiteSpect Start reducing your organization's Shadow IT risk in 3 steps What is enterprise architecture (EA)? - Definition from WhatIs.com Enterprise Architecture Governance - CIO Wiki