Exam CISA topic 1 question 717 discussion

It can not be answer C because unchanged business environment helps justify delays but doesn’t mitigate active threats.

C. If the business environment remains largely unchanged, the risks identified and accepted previously are likely still relevant and the controls in place may still be effective. This stability reduces the urgency and potential impact of not renewing the risk acceptances on time.

C. The business environment has not significantly changed since the risk acceptances were approved.

Answer D Option D emphasizes that the risk acceptances were previously reviewed and approved by appropriate senior management. This suggests that the risks were assessed and accepted at a higher level of authority, providing a level of assurance that the risks were understood and acknowledged by the organization's leadership. Therefore, in this context, Option D represents a more significant mitigating factor.

You should check whether there are changes to the business environment then check whether the compensating controls are still effective.