Study. uk . com
  1. Home
  2. All questions
  3. Question 276

CISM study material · question 276 of 1000

Which definition of risk appetite does IR 8286 adopt, and at what level is it set?

  1. The broad-based amount of risk the enterprise will accept in pursuit of its mission and vision, set at the top as strategic direction
  2. The residual risk remaining once the selected controls have been applied, calculated by the assessor and reported to the risk owner in each cycle
  3. The threshold above which a particular risk must be escalated, set by the internal auditor and then applied uniformly across the whole enterprise
  4. The maximum loss a single business unit may absorb, set by that unit
Show the answer

Answer: A. The broad-based amount of risk the enterprise will accept in pursuit of its mission and vision, set at the top as strategic direction

IR 8286 sets appetite at the top as strategic direction: how much risk, broadly, the enterprise is prepared to carry while pursuing what it exists to do.

Source: NIST IR 8286 (NIST) — Sec. 3.1.2 Risk Management Strategy

Challenge yourself on this topic → Study as cards