Section: Volume A
Explanation
Explanation:
The risk response process is triggered when a risk exceeds the enterprise's risk tolerance level. The acceptable variation relative to the achievement of an objective is termed as risk tolerance. In other words, risk tolerance is the acceptable deviation from the level set by the risk appetite and business objectives.
Risk tolerance is defined at the enterprise level by the board and clearly communicated to all stakeholders. A process should be in place to review and approve any exceptions to such standards.
Incorrect Answers:
A, C: Risk appetite level is not relevant in triggering of risk response process. Risk appetite is the amount of risk a company or other entity is willing to accept in pursuit of its mission. This is the responsibility of the board to decide risk appetite of an enterprise. When considering the risk appetite levels for the enterprise, the following two major factors should be taken into account:
* The enterprise's objective capacity to absorb loss, e.g., financial loss, reputation damage, etc.
* The culture towards risk taking-cautious or aggressive. In other words, the amount of loss the enterprise wants to accept in pursue of its objective fulfillment.
D: Risk response process is triggered when the risk level increases the risk tolerance level of the enterprise, and not when it just equates the risk tolerance level.

セクション: ボリューム D

リスク管理者が生産システムのリスク評価を実施した後に行う最も適切なアクションは、プロセス所有者に懸念事項を伝え、その懸念を軽減する対策を提案することです。プロセス所有者には、生産システムとそれに関連するリスクおよび制御を管理し、最適なリスク対応を決定する権限と責任があるからです。生産システムの懸念事項を最小限に抑えるプログラムを推奨したり、IT 管理者に懸念事項を伝えてその懸念事項を軽減する対策を提案したり、開発チームに懸念事項を伝えてリスク軽減対策を共同で策定したりすることは、生産システムとそのリスクに関する主要な利害関係者および意思決定者であるプロセス所有者が関与していない可能性があるため、最も適切なアクションではありません。参考文献 = CRISC レビューマニュアル、第 7 版、101 ページ。

説明/参照:
Explanation:
リスク対応プロセスは、リスクが企業のリスク許容レベルを超えたときに開始されます。目標達成に対する許容可能な変動は、リスク許容度と呼ばれます。言い換えれば、リスク許容度は、リスク選好度とビジネス目標によって設定されたレベルからの許容可能な偏差です。
Risk tolerance is defined at the enterprise level by the board and clearly communicated to all stakeholders.
A process should be in place to review and approve any exceptions to such standards.
Incorrect Answers:
A, C: Risk appetite level is not relevant in triggering of risk response process. Risk appetite is the amount of risk a company or other entity is willing to accept in pursuit of its mission. This is the responsibility of the board to decide risk appetite of an enterprise. When considering the risk appetite levels for the enterprise, the following two major factors should be taken into account:
The enterprise's objective capacity to absorb loss, e.g., financial loss, reputation damage, etc.

The culture towards risk taking-cautious or aggressive. In other words, the amount of loss the

enterprise wants to accept in pursue of its objective fulfillment.
D: Risk response process is triggered when the risk level increases the risk tolerance level of the enterprise, and not when it just equates the risk tolerance level.