Exam CGEIT topic 1 question 77 discussion

C. enables a consistent approach to risk management. The most beneficial aspect of utilizing an IT risk management framework is that it enables a consistent approach to risk management. A well-defined IT risk management framework provides a structured methodology, processes, and guidelines for identifying, assessing, prioritizing, mitigating, and monitoring IT-related risks across the organization. By establishing a consistent approach, the framework ensures that risks are managed systematically and comprehensively, regardless of the specific technology, department, or business unit involved. This consistency enhances the organization's ability to effectively manage and mitigate risks, leading to improved resilience and security of IT systems and assets.

The MOST beneficial aspect of utilizing an IT risk management framework is that it: C. enables a consistent approach to risk management. Here's why: Enables a consistent approach to risk management: An IT risk management framework provides a structured and systematic approach to identifying, assessing, and managing risks specific to IT. It establishes a set of guidelines, processes, and procedures that help ensure a consistent and standardized approach to risk management across the organization. This consistency enables clear communication, effective decision-making, and efficient allocation of resources in addressing IT-related risks.

ISACA's Risk Management Frameworks include the identification of risk. COSO's ERM has a line for risk assessment and the Risk IT Framework has a section dedicated to the identification of IT-related risks and opportunities, their analysis and subsequent presentation. This is the Risk Evaluation section. After this process, risk is articulated, addressed in a cost-effective manner and subsequently addressed. OCTAVE has a phase where vulnerabilities within the infrastructure must be identified, OGC's M_o_R is also another risk management framework that calls for the identification of risk and then selecting the appropriate risk response. Finally, NIST SP-800-37 (RMF) includes step 0: Prepare which details the assignment of Risk management roles, the creation of the strategy, then an enterprise-wide risk assessment where risks are identified.

C is more suitable answer as framework brings consistency

Risk management framework is not capable of identifying risk. It is a board set of guidelines for risk management of any enterprise