Key risk indicator (KRI): A metric that measures the level of risk exposure or the likelihood of a risk event1.
KRI threshold: A predefined value or range that triggers an alert or action when the KRI reaches or exceeds it2.
Loss expectancy: The estimated amount of loss that an organization may incur due to a risk event3.
The most helpful thing in developing KRI thresholds is loss expectancy information. Loss expectancy information provides an estimate of the potential or expected impact of a risk event on the organization's operations, reputation, or objectives. Loss expectancy information can help an organization to:
Quantify and prioritize the risks that pose the greatest threat to the organization Determine the acceptable level of risk exposure or tolerance for each risk Set the appropriate value or range for the KRI threshold that reflects the risk appetite and the risk mitigation strategy Monitor and measure the performance and effectiveness of the risk management process and controls Loss expectancy information can be derived from various sources, such as historical data, statistical analysis, expert judgment, or simulation models3.
The other options are not as helpful as loss expectancy information in developing KRI thresholds, because they do not directly address the potential or expected impact of a risk event.Control performance predictions, which are the forecasts or estimates of how well the risk management controls will perform in preventing, detecting, or mitigating risks, may help to evaluate the adequacy and efficiency of the risk management process and controls, but they do not provide a clear and quantifiable measure of the risk impact. IT service level agreements (SLAs), which are the contracts or agreements that define the quality and availability of IT services, may help to establish the standards and expectations for IT service delivery and performance, but they do not provide a comprehensive and current view of the risk exposure or likelihood. Remediation activity progress, which is the status or outcome of the actions taken to address and resolve a risk event, may help to monitor and report the effectiveness and compliance of the risk management process and controls, but it is usually done after the risk event has occurred and resolved, not before.
References = Key Risk Indicators: Definition, Examples, and Best Practices, KRI Framework for Operational Risk Management | Workiva, Loss Expectancy: Definition, Calculation, and Examples

Cost-benefit analysis is the most helpful tool to show risk reduction based on when developing risk treatment alternatives for a business case, because it compares the expected costs and benefits of each alternative and helps to select the most optimal and feasible one. Cost-benefit analysis also helps to justify the investment and resources required for the risk treatment plan and to demonstrate the value and return of the risk reduction.
The other options are not the most helpful tools, although they may also be considered when developing risk treatment alternatives. Risk appetite, regulatory guidelines, and control efficiency are examples of factors or criteria that influence the selection of risk treatment alternatives, but they do not show the risk reduction based on the alternatives. References = CRISC: Certified in Risk & Information Systems Control Sample Questions

* A risk register is a document that records and tracks the information about the risks that may affect the organization's objectives, such as the risk description, category, source, cause, impact, probability, status, owner, response, etc.
* When updating the risk register after a risk assessment, the most important information to include is the likelihood and impact of the risk scenario. This means that the risk register should reflect the current or updated estimates of the probability and consequence of the risk scenario, based on the risk analysis and evaluation methods and criteria.
* The likelihood and impact of the risk scenario helps to determine the risk level and priority, select the most appropriate risk response, allocate the resources and budget for risk management, and monitor and report the risk performance and outcomes.
* The other options are not the most important information to include when updating the risk register after a risk assessment. They are either secondary or not essential for risk management.
The references for this answer are:
* Risk IT Framework, page 29
* Information Technology & Security, page 23
* Risk Scenarios Starter Pack, page 21

The control owner is the person who has the authority to approve an exception to a control. A control is a policy, procedure, or technical measure that is implemented to prevent or mitigate a risk. A control owner is responsible for the design, implementation, operation, and maintenance of the control, as well as for monitoring and reporting its performance and effectiveness. A control owner is also accountable for the approval of any changes or exceptions to the control, based on the risk assessment and business justification.
An information security manager, a risk owner, and a risk manager are not the best choices, as they do not have the same level of authority, responsibility, and knowledge as the control owner in relation to the control. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 35.

Well-developed, data-driven risk measurements should be focused on providing a forward-looking view, as they enable the organization to anticipate and prepare for the potential changes and impacts of the risk level and exposure, and to take proactive and appropriate actions to address the risk. The other options are not the characteristics of well-developed, data-driven risk measurements, as they may not reflect the strategic, comprehensive, or timely aspects of the risk measurements, respectively. References = CRISC Review Manual, 7th Edition, page 110.