1. Home
2. All questions
3. Question 4

CISM study material · question 4 of 1000

Three business units each rate their top risk as high, but each derives that rating differently, so the executive committee cannot tell which risk deserves funding first. Which governance outcome most directly addresses this?

• Security governance
• Risk management

1. Delegating all prioritisation to the enterprise risk officer, who reranks each unit's submissions on judgement
2. Establishing and communicating one standardised method for calculating and prioritising risk
3. Converting every rating to a monetary figure before review
4. Requiring each unit to raise fewer risks, so that the executive committee is handed a shorter list at each quarterly review

Challenge yourself on this topic → Study as cards