Section: Volume D

リスク制限、しきい値、および指標は、現在のリスク レベルと残存リスク レベルを測定および監視し、それらを望ましいリスク レベルおよび許容可能なリスク レベルと比較するのに役立つため、制御の実装後のリスク露出を判断するための最も有用な情報を提供します。リスク制限、しきい値、および指標は次のように定義されます。
* リスク制限とは、組織が特定の活動、プロセス、または目標に対して受け入れるリスクの最大量です。リスク制限は組織のリスク選好度とリスク許容度から導き出され、リスク対応と制御の選択を導くのに役立ちます。
* リスクしきい値とは、リスクまたはパフォーマンスが許容可能または許容不可能となるポイントまたはレベルです。
Risk thresholds are used to trigger alerts, actions, or escalation when the risk or performance deviates from the expected or planned range.
* Risk indicators are metrics or measures that provide information on the current or potential risk exposure or performance. Risk indicators can be classified into key risk indicators (KRIs), which measure the likelihood and impact of risk events, and key performance indicators (KPIs), which measure the effectiveness and efficiency of controls and processes.
Risk limits, thresholds, and indicators help to determine risk exposure following control implementations by providing quantitative and qualitative data and feedback on the risk and control environment. They also help to identify and prioritize the areas for improvement and enhancement of the risk and control environment. Risk limits, thresholds, and indicators also facilitate the communication, collaboration, and accountability among the stakeholders involved in the risk management and control processes.
The other options are not the most useful information to determine risk exposure following control implementations. Strategic plan and risk management integration is the process of aligning the organizational strategy and objectives with the risk management framework and activities, but it does not provide specific information on the risk exposure or control effectiveness. Risk escalation and process for communication is the process of reporting and escalating the risk issues and incidents to the appropriate authority and stakeholders, but it does not provide comprehensive information on the risk exposure or control performance.
Policies, standards, and procedures are the documents that define the principles, rules, and guidelines for the risk management and control processes, but they do not provide actual information on the risk exposure or control implementation. References = Risk Limits, Thresholds and Indicators - ISACA, IT Risk Resources | ISACA, Risk Management: Risk Indicators and Risk Appetite