The correct answer isBbecausebusiness process ownersare accountable for the management of IT risk within the organization. In CRISC, risk accountability rests with those who own the business activities and processes affected by the risk. They are responsible for ensuring that risk is identified, assessed, treated, and monitored in a way that supports business objectives.
The other options are not the best answer:
* A. Senior managementapproves risk appetite, provides oversight, and signs off on plans, but accountability for specific business risk resides with the owners of the business processes and services.
* C. Second lineprovides oversight, guidance, framework support, and monitoring, but does not own the risk.
* D. Internal auditis independent and provides assurance; it does not manage or own IT risk.
Exact Extracts supporting the answer:
* "Accountability for business risk related to IT primarily lies with users of IT services."
* "For an IT system supporting a critical business process senior managers should be accountable for the risk."
* "For an organizational business unit the most accurate description of risk-related roles and responsibilities is that the management team owns the risk and is responsible for identifying assessing and mitigating risk and reporting to the appropriate support functions and the board of directors."
* "Risk owner is a risk management role that is part of the first line of defense."
* "Operational management is the function that manages risk according to the three lines of defense model." Taken together, these extracts show that accountability for IT risk is assigned to the first line, meaning business and operational owners, not assurance or oversight functions. Therefore,business process ownersare accountable for management of IT risk within the organization.

Control ownership is the assignment of roles and responsibilities for the design, implementation, monitoring, and improvement of controls that mitigate risks. Control ownership can help ensure that the controls are effective, efficient, and aligned with the business objectives and risk appetite. Control ownership can also help facilitate the communication, coordination, and accountability among the stakeholders involved in the risk management process. One of the factors that would present the greatest challenge when assigning accountability for control ownership is unclear reporting relationships. Reporting relationships are the formal or informal lines of authority and communication that define who reports to whom, and who is accountable for what. Unclear reporting relationships can create confusion, ambiguity, and conflict among the control owners and other stakeholders, such as the risk owners, the business owners, the auditors, the regulators, etc.
Unclear reporting relationships can also hinder the performance evaluation, feedback, and recognition of the control owners, and affect their motivation and commitment. Unclear reporting relationships can also increase the risk of duplication, inconsistency, or gaps in the control activities, and compromise the quality and reliability of the control environment. References = Defining, Assigning and Measuring: Accountability Challenges in 21st Century Governance, CRISC 351-400 topic3, Foundations of Project Management : Week
2.

Identifying and assessing the risk scenarios associated with IT strategic initiatives is the best risk management approach for the strategic IT planning process, because it helps to understand and evaluate the potential or actual threats or opportunities that may affect the achievement or implementation of the IT strategic initiatives, and to determine the appropriate risk responses and controls. A risk scenario is a hypothetical situation or event that describes the source, cause, consequence, and impact of a risk. A risk scenario can be positive or negative, depending on whether it represents an opportunity or a threat. An IT strategic initiative is a project or program that supports or enables the IT strategy, which is a plan that defines how IT supports and aligns with the organization's vision, mission, and strategy. The strategic IT planning process is a process of developing, implementing, and monitoring the IT strategy and its associated IT strategic initiatives.
Identifying and assessing the risk scenarios is the best risk management approach, as it helps to anticipate and prepare for the potential or actual outcomes of the IT strategic initiatives, and to optimize the risk-reward balance and the value delivery of IT. Establishing key performance indicators (KPIs) to track IT strategic initiatives, reviewing the IT strategic plan by the chief information security officer (CISO) and enterprise risk management (ERM), and developing the IT strategic plan from the organization-wide risk management plan are all possible risk management approaches for the strategic IT planning process, but they are not the best approach, as they do not directly address the identification and assessment of the risk scenarios associated with IT strategic initiatives. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.1.1, page 37

The correct answer isBbecause a change in business strategy that affects an application'srecovery point objective (RPO)means the organization's assessment of business criticality, recovery requirements, and time- sensitive dependencies has changed. These are determined through thebusiness impact analysis (BIA). The BIA is the key document and process used to identify critical business functions, dependencies, and recovery requirements such as recovery objectives.
The other options are less appropriate:
* A. IT inventorylists assets, but it does not determine business recovery requirements.
* C. Risk registermay eventually reflect related risk changes, but the primary source that drives recovery objective updates is the BIA.
* D. CMDBrecords configuration items and relationships, but not business-driven recovery requirements at the same level as a BIA.
Exact Extracts supporting the answer:
* "The main outcome of a business impact analysis (BIA) is the criticality of business processes."
* "The most useful process in developing a series of recovery time objectives is business impact analysis."
* "A business impact analysis is primarily used to evaluate the impact of disruption on an enterprise's ability to operate over time."
* "The objective of a business impact analysis is best described as the identification of time-sensitive critical business functions and interdependencies."
* "To best help an enterprise analyze risk incidents and related interdependencies to determine the impact on enterprise goals is a business impact analysis." These extracts show that recovery requirements are business-driven and are established through the BIA.
Therefore, if business strategy changes and RPO must be increased, thebusiness impact analysismust be updated.