Exam CRISC topic 1 question 550 discussion

Looks like D is the correct answer.

Risk appetite means nothing if our risk management is not aligned to business plans

D. Confirm the organization's risk appetite and tolerance. When evaluating enterprise IT risk management, the most important action is to "D. confirm the organization's risk appetite and tolerance." The effectiveness of IT risk management hinges on its alignment with the organization's overall risk appetite and tolerance levels. This step ensures that risk management efforts are aligned with the organization's strategic objectives and priorities. While the other options (creating new control processes, reviewing alignment with the investment plan, reporting identified risk scenarios to senior management) are all relevant aspects of IT risk management, they should be undertaken in light of the organization's risk appetite and tolerance to ensure that the risk management efforts are appropriate and aligned with the organization's risk management strategy.

Going with D though I believe that the question needs rewording

not sure. I am going with B since its about evaluation of the ERM.

Agree it is D

Agree.

Correct 'D'.

The answer is D - we should align the enterprise IT risk management program with our company's risk appetite and tolerance...

Correct: B -> The very first step is to check if IT and IT related activities (eg.: IT Risk Management) is always aligned with business. Overall, IT always support business, number 1 criteria. (Classic ISACA answers). If the activity is aligned with business, then checking answer D comes.

Risk assessment - comprises Identification, Analysis and Evaluation. Evaluation is when you decide what controls and cost. So, B seems right.

support D

support D