The most important topic to cover in a risk awareness training program for all staff is the policy compliance requirements and exceptions process. This topic would help the staff to understand the enterprise's risk policies, standards, and procedures, and how they apply to their roles and responsibilities. It would also help the staff to know the process for requesting, approving, and documenting any exceptions to the policies, and the consequences of non-compliance. This topic would enhance the staff's risk awareness and responsibility, and foster a culture of compliance and accountability within the enterprise. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.4.1, page 2491

The result of postponing the assessment and treatment of several risk scenarios is that the risk associated with these new entries has been accepted. Risk acceptance is a risk response strategy that involves acknowledging the existence of a risk and deciding not to take any action to reduce its likelihood or impact. By postponing the assessment and treatment of the risk scenarios, the organization is implicitly accepting the risk and its consequences. Risk mitigation, deferral, and transfer are other possible risk response strategies, but they are not applicable in this case. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 9; CRISC Review Manual, 6th Edition, page 137.

Determining the business purpose of the application is the first thing that a risk practitioner should do when a shadow IT application is identified in a business owner's business impact analysis (BIA), because it helps to understand the rationale and value of the application, and the potential risks and issues that it may introduce or affect. A shadow IT application is an IT system or application that is used by the business units or employees without the knowledge or approval of the IT department or management. A shadow IT application may offer benefits such as convenience, efficiency, or innovation, but it may also pose risks such as security breaches, data loss, compatibility issues, or regulatory non-compliance. A BIA is a process of analyzing the potential impact of disruption to the critical business functions or processes, and identifying the recovery priorities and requirements. A BIA may reveal the existence of a shadow IT application, as it may be used to support or enable a critical business function or process. Determining the business purpose of the application is the first thing to do, as it helps to evaluate the necessity and suitability of the application, and to plan the appropriate actions to address the shadow IT application. Including the application in the business continuity plan (BCP), segregating the application from the network, and reporting the finding to management are all possible things to do after determining the business purpose of the application, but they are not the first thing to do, as they depend on the results of the evaluation of the application. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 143

According to the CRISC Review Manual (Digital Version), the primary reason a risk practitioner would be interested in an internal audit report is to evaluate the maturity of the risk management process, as it provides an independent and objective assessment of the effectiveness and efficiency of the risk management activities and controls. An internal audit report helps to:
Identify and evaluate the strengths and weaknesses of the risk management process and its alignment with the organization's objectives and strategy Detect and report any gaps, errors, or deficiencies in the risk identification, assessment, response, and monitoring processes and controls Recommend and implement corrective actions or improvement measures to address the issues or findings in the risk management process Communicate and coordinate the audit results and recommendations with the relevant stakeholders, such as the risk owners, the senior management, and the board Enhance the accountability and transparency of the risk management process and its outcomes References = CRISC Review Manual (Digital Version), Chapter 4: IT Risk Monitoring and Reporting, Section 4.2: IT Risk Reporting, pp. 223-2241

When the cost of mitigating a risk exceeds the benefit,organizations may adjust their risk toleranceto accept a higher level of risk. Thus, financial feasibility influences how much risk the organization is willing to accept.
Reference:CRISC Manual - Domain 1, Slide 108-109