Discuss Isaca CISM Exam Topic 4 Question 83

Which of the following BEST enables the assignment of risk and control ownership?

AAligning to an industry-recognized control framework

BAdopting a risk management framework

CObtaining senior management buy-in

DDeveloping an information security strategy

Suggested Answer: C

Obtaining senior management buy-in is the best way to enable the assignment of risk and control ownership because it helps to establish the authority and accountability of the risk and control owners, as well as to provide them with the necessary resources and support to perform their roles. Risk and control ownership refers to the assignment of specific responsibilities and accountabilities for managing risks and controls to individuals or groups within the organization. Obtaining senior management buy-in helps to ensure that risk and control ownership is aligned with the organizational objectives, structure, and culture, as well as to communicate the expectations and benefits of risk and control ownership to all stakeholders. Therefore, obtaining senior management buy-in is the correct answer.

https://www.protechtgroup.com/en-au/blog/risk-control-management

https://www.mckinsey.com/~/media/mckinsey/dotcom/client_service/risk/working%20papers/23_getting_risk_ownership_right.ashx

https://www.linkedin.com/pulse/risk-controls-who-owns-them-david-tattam

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

37 comments · newest first

Gennie 10 months ago

D seems too broad for assigning specific risks.

Janna 11 months ago

C is crucial, can't overlook management buy-in!

Lettie 11 months ago

Surprised that people think A is best!

Glenn 11 months ago

I think B is more effective for ownership.

Tabetha 11 months ago

A is definitely the way to go!

Henriette 12 months ago

Developing an information security strategy sounds important, but I feel like it might be more about implementation than ownership assignment.

Desire 12 months ago

I'm a bit confused about the role of senior management buy-in in this context. Does it really help with assigning ownership?

Aide 12 months ago

I remember practicing a question similar to this, and I think adopting a risk management framework was emphasized as crucial for clarity in roles.

Veronique 1 year ago

I think aligning to an industry-recognized control framework might be the best option, but I'm not entirely sure how it directly relates to ownership.

Gwenn 1 year ago

I feel pretty confident that aligning to an industry-recognized control framework is the right answer here. That's the approach I'm going with.

Jennifer 1 year ago

Developing an information security strategy seems like it could be relevant, but I'm not sure if it's the BEST approach for assigning risk and control ownership specifically.

Leonora 1 year ago

Obtaining senior management buy-in is key for this type of initiative, so I'm leaning towards that as the best answer.

Vivan 1 year ago

Hmm, I'm a bit unsure about this one. I'm trying to decide between the control framework and the risk management framework options. I'll need to think it through carefully.

Florinda 1 year ago

This one seems pretty straightforward. I think aligning to an industry-recognized control framework is the best way to enable the assignment of risk and control ownership.

Emily 1 year ago

Ah, I remember learning about this in class. PAM modules are stored as shared object files in the /lib/ directory hierarchy, so I'll choose option D.

Farrah 2 years ago

I agree with Mable, it provides a structured approach to assigning risk and control ownership.

Mammie 2 years ago

But obtaining senior management buy-in is also crucial for effective risk management.

Corinne 2 years ago

Did someone say 'risk ownership'? That's my middle name! Option A all the way, gotta align with those industry standards, you know?

Sina 2 years ago

↳ replying to Corinne

Absolutely, it sets a solid foundation for managing risks.

Sheron 2 years ago

↳ replying to Corinne

It's important to have that alignment for effective risk management.

Angelyn 2 years ago

↳ replying to Corinne

Definitely, it helps in assigning clear ownership of risk and control.

Alethea 2 years ago

↳ replying to Corinne

I agree, aligning to an industry-recognized control framework is key.

Mattie 2 years ago

Ah, the old 'risk ownership' dilemma. I'd go with D - gotta have that information security strategy to know what we're even dealing with!

Jaclyn 2 years ago

↳ replying to Mattie

D) Developing an information security strategy

Renea 2 years ago

↳ replying to Mattie

C) Obtaining senior management buy-in

Earlean 2 years ago

↳ replying to Mattie

B) Adopting a risk management framework

Edelmira 2 years ago

↳ replying to Mattie

A) Aligning to an industry-recognized control framework

Aileen 2 years ago

Hmm, I'm torn between B and C. Both seem important, but I'd say C is the most critical step to get the ball rolling.

Micah 2 years ago

C is the way to go. Without senior management buy-in, it's gonna be really tough to get the necessary resources and support for risk ownership.

Talia 2 years ago

↳ replying to Micah

D) Developing an information security strategy

Matthew 2 years ago

↳ replying to Micah

C) Obtaining senior management buy-in

Jamika 2 years ago

↳ replying to Micah

B) Adopting a risk management framework

Gerald 2 years ago

↳ replying to Micah

A) Aligning to an industry-recognized control framework

Mable 2 years ago

I think the best way is to align to an industry-recognized control framework.

Jerilyn 2 years ago

I think option B is the best choice here. Adopting a risk management framework is crucial for assigning risk and control ownership.

Ligia 2 years ago

↳ replying to Jerilyn

I think obtaining senior management buy-in is also important for assigning risk and control ownership.

Honey 2 years ago

↳ replying to Jerilyn

I agree, adopting a risk management framework is essential for assigning ownership.

Isaca CISM Exam - Topic 4 Question 83 Discussion