Exam CGEIT topic 1 question 314 discussion

The MOST effective approach to ensure senior management sponsorship of IT risk management is to integrate IT risk into enterprise risk management (ERM). ERM is a framework for managing all risks that an organization faces, including IT risks. When IT risk is integrated into ERM, it means that senior management is aware of the IT risks that the organization faces and is committed to managing those risks.

It should be C. The most effective approach to ensure senior management sponsorship of IT risk management is to integrate IT risk into enterprise risk management (option C). This approach helps to align IT risk management with overall organizational objectives and helps to communicate the importance of IT risk management to senior management. Periodic review of the IT risk register entries (option A), benchmarking risk framework against best practices (option B), and calculating financial impact for each IT risk finding (option D) can also be useful, but they are not as effective as integrating IT risk into enterprise risk management.