Study. uk . com
  1. Home
  2. All questions
  3. Question 278

CISM study material · question 278 of 1000

Business units report risk levels on incompatible scales, so the enterprise cannot compare them. Which leadership responsibility does IR 8286 identify as missing?

  1. Providing guidance on risk calculation, including a common scale for assessing levels of risk
  2. Requiring every business unit to use quantitative analysis, so that the numbers arrive on a single scale
  3. Centralising all of the risk assessment work in one team, so that a single group applies the same judgement everywhere
  4. Appointing an external assessor for every unit, so that the ratings are produced by an independent party
Show the answer

Answer: A. Providing guidance on risk calculation, including a common scale for assessing levels of risk

IR 8286 states it is critical that enterprise leaders provide guidance regarding risk calculations, and that establishing a common scale for assessing levels of risk supports consistent estimation, measurement and reporting.

Source: NIST IR 8286 (NIST) — Sec. 3.1.2 Risk Management Strategy

Challenge yourself on this topic → Study as cards