Exam CGEIT topic 1 question 158 discussion

Mature risk management is not only about regularly conducting risk assessments but also about creating an environment where risk management is part of the organization's culture.

D. Ongoing investment in risk mitigation

C. Ongoing risk assessment. Mature risk management is a continuous process that involves regularly assessing and reassessing risks to identify new threats and vulnerabilities. It goes beyond having a static risk register and involves a dynamic understanding of the changing risk landscape.

D. Ongoing investment in risk mitigation BEST reflects mature risk management in an enterprise. While all of the options are important components of a mature risk management program, ongoing investment in risk mitigation is the most critical factor. This involves dedicating resources and funding to continuously identify, assess, and mitigate risks that may impact the organization's operations, financials, reputation, and compliance with regulatory requirements a regularly updated risk register is also an essential component of mature risk management. This allows the organization to track risks and monitor the effectiveness of risk mitigation measures. However, without ongoing investment in risk mitigation, a risk register can become a static document that does not reflect the changing risk environment.

should be B