Exam CRISC topic 1 question 603 discussion

Why not C?. The answer should be C.

Support C

C. Risk register. When reviewing the overall risk profile of a targeted organization as part of an acquisition consideration, the "C. Risk register" would provide the most useful information. The risk register contains a comprehensive list of identified risks, their associated attributes, and relevant details. By analyzing the risk register, the acquiring organization can gain insights into the specific risks that the targeted organization faces, the potential impact of those risks, and the existing risk management efforts. While the other components (risk appetite statement, risk management policies, enterprise risk management framework) are also important in understanding the risk management approach of the targeted organization, the risk register provides a detailed and practical view of the specific risks that need to be assessed and managed in the context of the acquisition.

By reviewing the targeted organization's risk register, the acquiring organization would gain insight into the types of risks that the targeted organization faces, the potential impact of those risks, and the controls that have been put in place to manage those risks. This information would be critical in assessing the overall risk profile of the targeted organization and determining the potential risks associated with the acquisition.

It is C.

While a risk register is a valuable tool for identifying and tracking specific risks within an organization, it may not provide the same level of comprehensive information on the overall risk profile and risk management practices of the targeted organization as an ERM framework would.

C is better

I believe that D is correct as it encompasses the total risk management framework of the organisation. RMF provides a process that integrates security, privacy, and cyber supply chain risk management activities into the system.

C NINJA