Study. uk . com
  1. Home
  2. All questions
  3. Question 279

CISM study material · question 279 of 1000

Which definition of inherent risk does IR 8286 quote?

  1. The maximum risk the organisation could survive
  2. The risk the organisation has formally chosen to accept after considering the alternatives available to it
  3. The risk remaining after all controls have been applied
  4. What an entity faces before management takes any direct, focused action to change its severity
Show the answer

Answer: D. What an entity faces before management takes any direct, focused action to change its severity

IR 8286 borrows COSO's definition: inherent risk is measured with management's deliberate interventions stripped out, which is what distinguishes it from residual risk.

Source: NIST IR 8286 (NIST) — Sec. 3.2 Identify the Risks

Challenge yourself on this topic → Study as cards