Exam CRISC topic 1 question 800 discussion

he best course of action for the risk practitioner in this situation is C. identify key risk indicators (KRIs) for ongoing monitoring. Here's why: Risk acceptance: The CTO has already accepted the risk, so trying to validate the decision or recommend revisiting it would not be effective. Proactive mitigation: Identifying KRIs is a proactive step that allows the organization to monitor the situation and take action if the risk becomes more severe. Data-driven decision-making: By tracking KRIs, the organization can gather data and insights into the potential impacts of the DoS attack. This information can be used to make informed decisions about resource allocation and further risk mitigation strategies. While updating the risk register is important, it should not be the first step after the CTO accepts the risk. Identifying KRIs is a more immediate and effective way to manage the accepted risk.

Agree it is A.

Risk acceptances must be done by the business and validated. A

D. update the risk register with the selected risk response. In this situation, the risk practitioner's best course of action is to update the risk register with the selected risk response, as the CTO has decided to accept the risk. This ensures that the risk register accurately reflects the organization's risk management decisions and the accepted risk level.