Exam CISM topic 1 question 428 discussion

The culture (C) Helps but not only in compliance. The best option is "risk management is built into operational and strategic activities"

D. risk management is built into operational and strategic activities

By incorporating risk management into day-to-day operations and long-term strategic planning, organizations can ensure that security risks are identified, assessed, and appropriately addressed. This approach allows for a proactive and systematic approach to managing risks, rather than treating them as isolated incidents or afterthoughts. Option D

D. Risk management is built into operational and strategic activities The effectiveness of an information security governance framework will best be enhanced if risk management is built into operational and strategic activities. This means that the organization considers and manages information security risks as part of its day-to-day operations and decision-making processes. When risk management is integrated into organizational activities, it becomes a fundamental part of the organization's culture, and not just an isolated function. This allows the organization to more effectively identify, evaluate, and mitigate information security risks, and to align its information security efforts with its overall business goals and objectives.

I guess D

audit will enhance framework.