1. Home
2. All questions
3. Question 72

CISM study material · question 72 of 1000

An organisation assigns a large portfolio of risks to an owner who has no training or experience in that domain. What does IR 8286 say about this arrangement?

• Security governance
• Risk management

1. The arrangement is acceptable provided a subject matter expert is consulted before each decision, since the expertise sits with the adviser rather than the owner
2. Ownership is an administrative assignment, so the owner's own expertise does not affect outcomes as long as the register entries are kept current and reviewed on schedule
3. The knowledge, training and experience of the risk owner is itself a significant risk to control effectiveness, so staff capability should be assessed
4. Risk ownership must always be held by the enterprise risk officer

Challenge yourself on this topic → Study as cards