Study. uk . com
  1. Home
  2. All questions
  3. Question 70

CISM study material · question 70 of 1000

An enterprise risk steering committee wants assurance that the risk process it mandated is genuinely being applied across the business. Which role provides that?

  1. The auditor, giving independent and formal verification
  2. The cybersecurity risk officer, reporting on their own systems
  3. The common control provider, reporting on inherited controls
  4. The chief financial officer, reviewing investment cost goals
Show the answer

Answer: A. The auditor, giving independent and formal verification

IR 8286 casts the auditor as the source of independent, formal confirmation that enterprise objectives are being met and that the risk management process is genuinely in use — which is what the committee is asking for.

Source: NIST IR 8286 (NIST) — Sec. 3.1.1 Notional Risk Management Roles

Challenge yourself on this topic → Study as cards