Exam CRISC topic 1 question 786 discussion

I would rather go with A , as effectiveness point with implementation

A. Time between when IT risk scenarios are identified and the enterprise's response. The promptness of response after identifying IT risk scenarios is a strong indicator of the effectiveness of the IT risk management processes. It signifies how agile and proactive the organization is in addressing and mitigating risks. While the other options provide some insight into the organization's risk management maturity, the ability to swiftly react to identified risks is a more direct measure of process effectiveness.

Agree it is A

7th CRISC manual, 'alignment of risk response with business objectives': [...] first determine the best response and then develop the action plan and implementation strategy. The best indicator of effectiveness is the implementation of the plan.

A: is my choice I would think that it effectiveness refers to the time between identifying IT scenarios and enterprises' response. C: Just having an Risk action plan for High risk scenarios may not be IT scenarios as the questions asks

I stand with C. effectiveness of IT risk management processes, even the time of risk identify and response is fast. But the risk is for currently identified and make a priority. The risk response can not be decrease the risk. I pick C. As high risk is address, the total risk can be effectively address and reduce the resident risk to acceptable level.

also thik a is more suitable