When tailoring COBIT 2019 to enterprise requirements, which of the following is the PRIMARY objective of preparing a risk profile?

The risk profile is a design factor that describes how an enterprise identifies, assesses, responds to,

monitors, and reports on information and technology risks. The risk profile helps to determine the

level of risk appetite and tolerance that an enterprise has for its information and technology

activities, as well as the level of control and assurance that is required for its governance framework.

When tailoring COBIT 2019 to enterprise requirements, the primary objective of preparing a risk

profile is to identify areas of risk that exceed risk appetite. The risk appetite is the amount and type

of risk that an enterprise is willing to accept in pursuit of its objectives. The risk appetite provides a

basis for defining the risk criteria, thresholds, indicators, and responses that will be used in the risk

profile process. By identifying areas of risk that exceed risk appetite, an enterprise can prioritize its

governance objectives, processes, practices, roles, structures, and metrics according to the level of

risk exposure and impact. This will also help to align the governance framework with the enterprise’s

strategy and objectives.

Reference: : COBIT 2019 Design Guide: page 41-43 : COBIT 2019 Framework: Introduction and

Methodology: page 28-29