Study. uk . com
  1. Home
  2. All questions
  3. Question 32

CISM study material · question 32 of 1000

Following a major loss, an executive argues they cannot be held responsible because they personally approved no individual risk decision. Under SP 800-39, why is this defence incomplete?

  1. Executives are accountable only where an audit finding names them personally, so one who approved no individual decision carries none
  2. Accountability passes to the risk executive function once it is established, leaving executives answerable only for resourcing that function adequately
  3. Accountability rests with whoever implemented the control that failed, since execution rather than direction is where the loss actually arose
  4. Executives are accountable both for their risk decisions and for implementing an effective organisation-wide risk programme
Show the answer

Answer: D. Executives are accountable both for their risk decisions and for implementing an effective organisation-wide risk programme

SP 800-39 makes senior leaders accountable for their risk management decisions and for the implementation of effective, organisation-wide risk management programmes. Absence of a specific decision does not discharge the second duty.

Source: NIST SP 800-39 (NIST) — Ch. 1 Introduction

Challenge yourself on this topic → Study as cards