Exam CRISC topic 1 question 843 discussion

A. Changes in senior management. The risk profile of an organization represents a summarized view of its risks, taking into account the probability of occurrence, potential impacts, and the effectiveness of controls in place. Changes in the leadership or direction of the organization, such as changes in senior management, can directly influence its risk tolerance, strategic direction, and priorities, which would likely lead to updates in its IT risk profile. Establishment of a risk committee (Option B) can provide more structured governance around risk management, but the mere establishment of such a committee doesn't necessarily change the risk profile itself. External audit findings (Option C) can highlight weaknesses or gaps in controls and may lead to changes in risk responses or mitigation strategies, but they might not lead to changes in the overall risk profile unless the findings reveal risks that weren't previously recognized. Feedback from focus groups (Option D) is typically more about perceptions and preferences of a specific topic and might not have a direct impact on the IT risk profile.

Agree it is C.