Exam CRISC topic 1 question 730 discussion

What framework are the refering to in a? Also question asks about the way results should be presented, so i think i would go with C

While management's needs are important, the framework often dictates the technical approach to risk analysis, which would define whether the presentation should be quantitative or qualitative. Management may want quantitative data, but if the framework primarily uses qualitative terms, that will shape how risk results are communicated

The preferences and requirements of management are crucial because they are the primary stakeholders who will use this information to make informed decisions about risk management. Management's decision-making process, familiarity with risk metrics, and strategic needs will dictate whether a quantitative or qualitative presentation is more effective for understanding and responding to risks. Ensuring that the risk analysis aligns with their needs supports better communication and more effective risk management.

C. requirements of management. The way in which risk analysis results are presented (either quantitatively or qualitatively) should primarily cater to the needs and understanding of management. This is because management uses these results to make informed decisions. If they prefer or require a certain format to better comprehend and act upon the information, then the risk analysis results should be tailored to those specifications. While the other options are relevant in the context of risk analysis: A. The specific risk analysis framework might have its own methodologies for presenting results, but ultimately it should be tailored to the organization's and management's needs. B. The results of the risk assessment do play a role in the overall presentation, but it's not the primary determinant of whether the results are qualitative or quantitative. D. Organizational risk tolerance is crucial in decision-making, but it doesn't dictate the format in which risk analysis results are presented.

C. Requirements of management. According to ISACA, the presentation of risk analysis results should be based on the needs and expectations of the intended audience, which is usually the management of the organization

Agree it is A.

Agree.