Study. uk . com
  1. Home
  2. All questions
  3. Question 233

CISM study material · question 233 of 1000

A consultant asserts there is an objectively correct level of risk tolerance for an organisation of a given size. How does SP 800-39 characterise risk tolerance?

  1. It is determined by the organisation's revenue and headcount, which together fix how much loss it could absorb in any single year without distress
  2. It is fixed by the applicable regulatory regime
  3. It is derived arithmetically from the residual risk figures
  4. There is no correct level; it reflects culture, can differ by type of loss, and is coloured by executives' personal outlook
Show the answer

Answer: D. There is no correct level; it reflects culture, can differ by type of loss, and is coloured by executives' personal outlook

SP 800-39 states there is no correct level of organisational risk tolerance: it is indicative of culture, potentially different for different types of loss, and highly influenced by the subjective risk tolerance of senior executives.

Source: NIST SP 800-39 (NIST) — Sec. 2.3.3 Risk Management Strategy

Challenge yourself on this topic → Study as cards