When tailoring COBIT 2019 to enterprise requirements, which of the following is the PRIMARY objective of preparing a risk profile?

The primary objective of preparing a risk profile, as defined within the COBIT 2019 framework, is to understand the enterprise's current exposure to I&T-related risk and, most importantly, to determine which of those risks exceed the board-approved risk appetite. This comparison is a critical input for tailoring the governance system. By identifying where actual risk surpasses acceptable levels, the enterprise can prioritize the selection and implementation of relevant governance and management objectives to bring risk within tolerance. This aligns the governance system directly with the enterprise's risk-taking philosophy.

A. To identify areas of risk that require mitigation: This is a subsequent action. The primary step is identifying that a risk exceeds the appetite; the decision to mitigate is a response to that finding.
B. To identify areas of risk that cause technology disruption: This is too specific. A risk profile is comprehensive and includes various risk categories, not just those leading to technology disruption.
C. To identify areas of risk that impact business continuity: This is also a specific category of risk. The enterprise risk profile encompasses a broader spectrum of I&T-related risks beyond just business continuity.

1. ISACA, COBIT® 2019 Framework: Introduction and Methodology, 2018, p. 35. The text describing Design Factor 4, "Risk Profile," explicitly states, "The risk profile of the enterprise identifies the risk-related issues to which the enterprise is currently exposed. It indicates which areas of risk are exceeding the risk appetite."

2. ISACA, COBIT® 2019 Design Guide: Designing an Information and Technology Governance Solution, 2018, p. 21. In the section for Design Factor 4, it reiterates, "The risk profile identifies the sort of I&T-related risk to which the enterprise is currently exposed and indicates which areas of risk are exceeding the risk appetite." This directly supports that comparing risk exposure to appetite is the key function.