Exam CRISC topic 1 question 558 discussion

For sure, KRI thresholds are set based on the organization tolerance level, any change in the risk appetite, we have to adjust the thresholds. Agree with CbtL, inherent risk changes when there is a new business opportunity

Agree it is D. Your inherent risk changes when you have a change of business activity. If you change risk appetite, your inherent risk does not get altered. (Also agree john_boogieman is usually correct)

Normally John boogieman is spot on but I have to disagree on this one. Management's risk appetite is the amount and type of risk an organization is willing to take to achieve its objectives. A change in risk appetite can result in changes to the key risk indicator (KRI) thresholds, as these thresholds are typically set based on the organization's tolerance for risk. Adjusting the KRI thresholds allows the organization to reflect the new risk appetite in its monitoring and reporting processes.

The inherent risk level is most likely to change as a result of a change in management's risk appetite. When management's risk appetite changes, it affects the organization's tolerance for risk, which may require adjusting the inherent risk level of a particular risk in the risk register. This is because inherent risk represents the level of risk that exists without any mitigating controls in place, and the level of inherent risk will determine the organization's overall risk exposure. Therefore, a change in risk appetite will likely impact the organization's tolerance for certain risks and may require adjustments to the inherent risk levels in the risk register.