Exam CISM topic 1 question 670 discussion

Requiring steering committee approval of risk treatment plans is the BEST way to help ensure an organization's risk appetite will be considered as part of the risk treatment process, so the correct answer is C.

C - Steering committee to ensure that risk treatment plans are aligned with the organization’s risk appetite and strategic objectives. C (KRI) is useful for monitoring risk levels.

Answer C, requiring steering committee approval of risk treatment plans, is the BEST way to help ensure an organization's risk appetite is considered as part of the risk treatment process. By involving the steering committee, which typically consists of senior management and key stakeholders, the organization can ensure that risk treatment plans align with the organization's overall risk appetite and strategic objectives. This approach helps to ensure that decisions about risk treatment are made at the highest level of the organization and are in line with the organization's risk tolerance and business objectives.

The steering committee, often comprised of senior management and other key stakeholders, is responsible for ensuring that an organization's strategic objectives are met, including adherence to its risk appetite. By requiring their approval of risk treatment plans, you can ensure that the organization's risk appetite is actively considered and upheld during the risk treatment process.

A. Establish key risk indicators (KRIs).

Establishing key risk indicators allows the organization to define and monitor specific metrics that reflect its risk appetite. KRIs provide a quantitative or qualitative measurement of risk and help in assessing whether the risk treatment options align with the organization's desired risk tolerance. By defining and monitoring KRIs, the organization can track risk levels, identify potential deviations from the desired risk appetite, and take appropriate actions to address any significant variances. This enables a proactive approach to risk management and ensures that risk treatment decisions are consistent with the organization's risk appetite.

YES IS THE C