MENU
An employee has worked on the organizational risk assessment. The goal of the assessment is not to bring residual risks to zero, but to bring the residual risks in line with an organization's risk appetite.
When has the risk assessment program accomplished its primary goal?
Suggested Answer: C
Get Premium ISMP Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
18 comments · newest first
HE
Herminia
11 months ago
D is just about completing the analysis, not the goal of the program.
CO
Coleen
11 months ago
Wait, can we really just leave risks in place? That sounds risky!
YV
Yvonne
11 months ago
A seems too simplistic; controls alone don't mean risks are managed.
HI
Hildegarde
11 months ago
I think it's C. Decision makers need to know about the risks!
RO
Ronny
11 months ago
The goal is to align with risk appetite, not eliminate all risks.
EL
Elke
12 months ago
I feel pretty confident about this one. The goal is to bring the residual risks in line with the organization's risk appetite, not to eliminate them entirely. So the answer is option C, where the decision-makers have been informed and have decided to leave the uncontrolled risks in place.
BR
Brittani
12 months ago
This is a tricky one. I'm not entirely sure about the difference between "residual risks" and the organization's "risk appetite." I'll need to review those concepts before answering.
JO
Josephine
12 months ago
Okay, I think I've got it. The question is asking when the risk assessment program has accomplished its primary goal, which is to align the residual risks with the organization's risk appetite, not to eliminate them completely. I'll go with option C.
HA
Harrison
1 year ago
Hmm, I'm a bit confused by the wording here. Is the goal to completely eliminate the risks, or just to bring them in line with the organization's risk tolerance? I'll need to think this through carefully.
AI
Aileen
1 year ago
This seems like a straightforward question about risk assessment. I think the key is understanding the goal of the assessment, which is to align residual risks with the organization's risk appetite, not necessarily to eliminate all risks.
BI
Billye
1 year ago
I’m leaning towards D because completing the risk analysis seems like a necessary step, but I wonder if that alone is enough to say the goal is accomplished.
DA
Darrin
1 year ago
I feel like it's about understanding the risks and making informed decisions, which sounds like C again. But what if they just leave the risks as is?
AU
Audra
1 year ago
I think the goal is reached when decision makers are aware of the risks, so maybe it's option C? But I'm not entirely sure.
YU
Yuki
1 year ago
I remember a practice question that emphasized the importance of controls. Could it be A, once the controls are implemented?
YU
Yun
1 year ago
Hmm, this seems like a tricky one. I'll need to think through the different options carefully.
KE
Kenneth
1 year ago
I actually recall seeing 'domain service inventories' in our textbook. Not 100% confident, but I feel like that's the right answer!
MA
Maryann
1 year ago
This seems like a tricky one. I'll need to think carefully about the potential issues that could arise from sharing the requirements document too quickly.
RO
Roslyn
1 year ago
Wait, I'm a little confused. Is the query parameter supposed to be the "Action" that the request is performing? Or is it something else? I'll have to re-read the question and consider the options more closely.