To support effective risk decision making, which of the following is MOST important to have in place?

Effective risk decision-making is contingent upon the availability of timely, accurate, and relevant information. Established risk reporting procedures provide the formal mechanism to communicate the organization's risk posture, the status of risk mitigation efforts, and the potential impact of identified risks to senior leadership and other key stakeholders. This structured communication is the primary input for making informed, risk-based decisions regarding resource allocation, strategic direction, and risk acceptance or mitigation. Without a reliable reporting process, decision-makers lack the necessary visibility to effectively govern risk.

A. Established risk domains are useful for categorizing and organizing risks, but they do not provide the dynamic, actionable information required for ongoing decision-making.

C. An audit committee is a governance body, but it should consist of independent board members, not mid-level management, to ensure proper oversight and avoid conflicts of interest.

D. Well-defined controls are the result of risk mitigation decisions. They are implemented in response to a decision, rather than being the primary input for making the decision itself.

1. ISACA

CISM Review Manual

15th Edition. Chapter 2

Section 2.5

"Information Risk Monitoring and Reporting." This section explicitly states

"The purpose of risk monitoring is to provide stakeholders with the necessary information to make risk-based decisions... Reporting should be tailored to the audience... to ensure that the information is useful for decision making." This directly links reporting procedures to enabling effective decisions.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. EDM03 Ensure Risk Optimization

Practice EDM03.03 "Monitor risk management." This practice emphasizes the need to "Monitor the key goals and metrics of the risk management processes and establish how deviations or problems will be identified

tracked

and reported for remediation." This highlights reporting as a critical governance activity that informs decision-making.

3. NIST Special Publication 800-39

Managing Information Security Risk: Organization

Mission

and Information System View. Section 2.4

"Risk Monitoring." The document describes risk monitoring as a process to verify control implementation and determine effectiveness. The outputs of this monitoring process are communicated to decision-makers to support "subsequent risk-based decisions." This underscores that reporting the results of monitoring is essential for the decision-making cycle.