An IS auditor is planning an audit of an organization's risk management practices. Which of the following would provide the MOST useful information…

Risk appetite is the amount and type of risk that an organization is prepared to pursue, retain, or take. This is a strategic, high-level decision made by senior management and the board of directors. The most formal and authoritative source for an organization's intended risk appetite is its risk policies. These policies codify and communicate management's direction and intent regarding risk-taking, setting the tone and providing the guiding principles for all risk management activities across the enterprise. An IS auditor would review these policies first to understand the established and approved boundaries for acceptable risk.

B. Risk assessments identify, analyze, and evaluate specific risks; they do not define the organization's overall acceptable level of risk (appetite).

C. Prior audit reports identify historical control weaknesses and may imply a certain risk tolerance but do not formally state the organization's intended risk appetite.

D. While management defines the risk appetite, a formal, board-approved policy is the most reliable and official source, rather than a potentially informal assertion.

1. ISACA

CISA Review Manual

27th Edition

2019. Domain 2: Governance and Management of IT

Section 2.4

"IT Governance Framework

" discusses how policies are the primary means to communicate management's intent and guidance

which includes the organization's risk appetite and tolerance.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives

2018. Governance Objective EDM03

"Ensured Risk Optimization

" states that a key activity for the board/governing body is to "Set the business- and risk-related context for the enterprise

including its risk appetite." This direction is then formalized and communicated through policies.

3. Sobel

P. J.

& Reding

K. F. (2012). Enterprise Risk Management: Achieving and Sustaining Success. The Institute of Internal Auditors Research Foundation. Chapter 3

"ERM and Strategy

" explains that the board of directors is responsible for approving the risk appetite statement

which is then documented in the organization's risk management policy.