Study. uk . com
  1. Home
  2. All questions
  3. Question 260

CISM study material · question 260 of 1000

Which two kinds of information does IR 8286 say a risk detail record holds that the register itself does not? Choose two.

  1. The organisation's overall risk appetite statement
  2. The board minutes approving the risk strategy
  3. The considerations and assumptions behind the risk decision
  4. The personnel involved and the schedules for action
Show the answer

Answer: C. The considerations and assumptions behind the risk decision
D. The personnel involved and the schedules for action

IR 8286 says risk detail records document the considerations, assumptions and results of risk management activity, and enable recording of the personnel involved, actions to be taken and schedules.

Source: NIST IR 8286 (NIST) — Sec. 3 Risk Detail Record

Challenge yourself on this topic → Study as cards