Isaca Updated CRISC Exam Questions and Answers by diana

Risk appetite reflects the organization’s tolerance for risk, including noncompliance risks. Senior management’s determination of acceptable risk levels influences strategic decisions, aligning with the principles of Governance and Risk Management.

The organizational role that should be accountable for ensuring information assets are appropriately classified is the information asset owner, as they have the authority and responsibility to define the classification, retention, and disposal requirements for the information assets they own, and to manage the risk and controls related to the information assets. The other options are not the correct roles, as they have different roles and responsibilities related to the protection, governance, or maintenance of the information assets, respectively, rather than the classification of the information assets. References = CRISC Review Manual, 7th Edition, page 154.

The primary focus of an ongoing risk awareness program should be to enable better risk-based decisions, as this can help the organization to achieve its objectives, optimize its performance, and manage its risks effectively. An ongoing risk awareness program is a process of educating, communicating, and engaging the stakeholders about the organization’s risk management framework, methodology, and practices. An ongoing risk awareness program can help the stakeholders to understand the risk context, criteria, appetite, and profile of the organization, and to identify, assess, treat, monitor, and review the risks that may affect their roles and responsibilities. By doing so, an ongoing risk awareness program can empower the stakeholders to make informed and rational decisions that balance the benefits and costs of risk-taking, and that align with the organization’s strategy and goals.

References:

•ISACA, Risk IT Framework, 2nd Edition, 2019, p. 761

•ISACA, Managing Human Risk Requires More Than Just Awareness Training2

Notifying the incident response team ensures immediate action to contain and remediate the malware spread, limiting further impact. This aligns with Incident Response and Containment protocols under risk management.