Which of the following should management consider when selecting a risk mitigation option?

When selecting a risk mitigation option, management should consider the cost of control

implementation, as well as the benefits and residual risks. The cost of control implementation

includes the direct costs of acquiring, installing, and maintaining the control, as well as the indirect

costs of potential side effects, suchas reduced performance, increased complexity, or decreased user

satisfaction. The cost of control implementation should be balanced with theexpected reduction in

risk exposure and the alignment with the enterprise’s risk appetite and tolerance. The maturity of

the enterprise architecture, the reliability of key performance indicators (KPIs), and the reliability of

key risk indicators (KRIs) are relevant factors for risk identification and assessment, but not for risk

response selection. Reference = Risk and Information Systems Control Study Manual, Chapter 4: Risk

Response, page 149.