Study. uk . com
  1. Home
  2. All questions
  3. Question 68

CISM study material · question 68 of 1000

An organisation set its risk strategy three years ago and treats it as settled. According to IR 8286, why is this inadequate?

  1. The risk landscape evolves with technological and environmental change, so leaders should continually review and adjust the strategy
  2. Only a regulator may authorise a change to risk strategy, so the organisation must wait for a supervisory review before it revises its direction
  3. A strategy may be revised only after a material incident
  4. Risk strategies formally expire after two years
Show the answer

Answer: A. The risk landscape evolves with technological and environmental change, so leaders should continually review and adjust the strategy

IR 8286 states that as the risk landscape evolves through technological and environmental change, enterprise leaders should continually review and adjust the risk strategy rather than setting it once.

Source: NIST IR 8286 (NIST) — Sec. 3.1.2 Risk Management Strategy

Challenge yourself on this topic → Study as cards