Providing assurance on risk management processes is the activity that should only be performed by the third line of defense, because it is the role and responsibility of the independent and objective assurance function, such as internal audit or external audit, to evaluate and report on the effectiveness and efficiency of the risk management processes and controls. The third line of defense is the last layer of the three lines of defense model, which is a framework that defines the roles and responsibilities of different functions and levels within the organization for risk management and control. The first line of defense is the operational management and staff, who are responsible for identifying, assessing, and managing the risks and controls within their areas of responsibility. The second line of defense is the oversight and support functions, such as risk management, compliance, or legal, who are responsible for establishing and monitoring the risk policies, standards, and frameworks, and providing guidance and advice to the first line of defense. The third line of defense is the assurance function, who are responsible for providing independent and objective assurance on the adequacy and effectiveness of the risk management processes and controls, and reporting to the senior management and the board of directors. Operating controls for risk mitigation, testing the effectiveness and efficiency of internal controls, and recommending risk treatment options are all activities that can be performed by the first or second line of defense, but not by the third line of defense, as they are not part of the assurance function.
References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.4.1, page 59

A risk register is a document that records and tracks the information and status of the identified risks and their responses. It includes the risk description, category, source, cause, impact, probability, priority, response, owner, action plan, status, etc.
A risk register update is a change or modification to the information or status of the risks and their responses in the risk register. It may be triggered by the occurrence or resolution of a risk event, the identification or evaluation of a new or emerging risk, the implementation or completion of a risk response, the monitoring or review of the risk performance, etc.
The most important risk register update for senior management to review is avoiding a risk that was previously accepted, which means that the organization has decided to eliminate or withdraw from the risk exposure or activity that may cause the risk, instead of tolerating or retaining the risk as before. This may indicate a significant change in the organization's risk appetite, strategy, objectives, or environment, and it may have a major impact on the organization's performance and value.
The other options are not the most important risk register updates for senior management to review, because they do not indicate a significant change or impact on the organization's risk profile or performance.
Extending the date of a future action plan by two months means that the organization has postponed the implementation or completion of the planned actions or measures to address the risk, due to some reasons or constraints. This may indicate a delay or deviation from the expected or desired risk outcome, but it may not have a major impact on the organization's performance and value, unless the risk is very urgent or critical.
Retiring a risk scenario no longer used means that the organization has removed or discarded the risk scenario that is no longer relevant or applicable to the organization's objectives or operations, due to some changes or developments. This may indicate a reduction or improvement in the organization's risk exposure or level, but it may not have a major impact on the organization's performance and value, unless the risk scenario was very significant or influential.
Changing a risk owner means that the organization has assigned or transferred the responsibility and accountability for the risk and its response to a different person or role, due to some reasons or circumstances.
This may indicate a change or improvement in the organization's risk governance or culture, but it may not have a major impact on the organization's performance and value, unless the risk owner was very ineffective or inappropriate. References = ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55, 58-
59, 62-63
ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 160 CRISC Practice Quiz and Exam Prep

When a risk is accepted, it must be documented in the risk register-including rationale, alternatives evaluated, decision-makers, and contextual factors. This aligns with governance and audit accountability requirements in ISACA guidance.

Prioritizing threats and controls helps tofocus resources and mitigationon high-risk elements that directly impact project objectives. This enhances decision-making and project alignment with business goals.
Reference:CRISC Manual - Domain 2, Slide 170-173

The correct answer isBbecause when a business unit cannot fully implement a required security policy, the best way to manage the related risk is through anexception managementprocess. This allows the deviation to be formally reviewed, justified, approved by the appropriate authority, documented, and monitored with awareness of the resulting residual risk.
The other options are less appropriate:
* A. Change managementcontrols how changes are introduced, but it does not formally manage policy deviations.
* C. Configuration managementhelps maintain technical baselines, but it does not address acceptance of noncompliance with policy.
* D. Incident managementis used after an event occurs, not for governing approved deviations from policy.
Exact Extracts supporting the answer:
* "In the absence of a formal policy on personal devices in the workplace the risk practitioner should recommend implementing an exception process based on appropriate approvals."
* "The primary reason for initiating a policy-exception process is the risk being justified by the benefit."
* "When an enterprise wants to quickly implement a technical solution that deviates from the company's policies the risk practitioner should recommend a risk assessment and subsequent implementation only if residual risk is accepted."
* "The BEST way to ensure appropriate mitigation occurs on identified information systems vulnerabilities is by assigning action plans with deadlines to responsible personnel." These extracts directly support that a formalexception managementprocess is the best mechanism for managing risk when policy cannot be fully implemented.