A key performance indicator (KPI) is a metric that measures the achievement of a specific goal or objective.
A KPI for the internal control that requires all access for employees be removed within 15 days of their termination date could be the percentage of employees whose access was removed within the specified time frame. This KPI would help the risk practitioner to monitor the compliance and effectiveness of the control and identify any deviations or issues.
References
*Key Performance Indicators (KPIs) - ISACA
*How to Improve Risk Awareness in the Workplace [+ Template] - AlertMedia
*[SITXWHS

According to the CRISC Review Manual1, the business owner is the person who has the authority and accountability for the achievement of the business objectives and the management of the associated risks. The business owner is ultimately responsible for ensuring that the IT services and solutions support the business needs and goals, and for accepting or rejecting the residual risks after the implementation of risk responses. Therefore, the business owner should own the risk associated with calculation errors, as they are the ones who will be affected by the potential impact of the errors on the financial data and decisions. References = CRISC Review Manual1, page 194.

A deterrent control is a type of control that has been implemented by displaying a poster that reads "Anyone caught taking photographs in the data center may be subject to disciplinary action.", as it aims to discourage or prevent unauthorized or malicious activities by warning the potential perpetrators of the consequences or sanctions. The other options are not the correct types of control, as they are more related to the correction, detection, or prevention of unauthorized or malicious activities, respectively, rather than the deterrence of unauthorized or malicious activities. References = CRISC Review Manual, 7th Edition, page 154.

Senior management's primary consideration in selecting risk response strategies is alignment with the organization's risk appetite, ensuring that responses are consistent with the levels of risk the organization is willing to accept. While BIA results, KRIs, and investment portfolios inform decisions, risk appetite provides the guiding framework for prioritization and decision-making