Section: Volume C
Explanation:
Risk factors are those features that influence the likelihood and/or business impact of risk scenarios. They have heavy influences on probability and impact of risk scenarios. They should be taken into account during every risk analysis, when likelihood and impact are assessed.
Incorrect Answers:
A: The enterprise must consider risk that has not yet occurred and should develop scenarios around unlikely, obscure or non-historical events.
Such scenarios can be developed by considering two things:
* Visibility
* Recognition
For the fulfillment of this task enterprise must:
* Be in a position that it can observe anything going wrong
* Have the capability to recognize an observed event as something wrong C: A risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to these threats. A risk from an organizational perspective consists of:
* Threats to various processes of organization.
* Threats to physical and information assets.
* Likelihood and frequency of occurrence from threat.
* Impact on assets from threat and vulnerability.
Risk analysis allows the auditor to do the following tasks:
* Identify threats and vulnerabilities to the enterprise and its information system.
* Provide information for evaluation of controls in audit planning.
* Aids in determining audit objectives.
* Supporting decision based on risks.
D: リスク イベントは、特定の確率でのみ発生するリスクがあり、そのリスク自体が指定された分布によって表される状況を表します。

説明/参照:
Explanation:
制御または監視ツールの持続可能性とは、時間の経過や環境に変更が加えられた場合に期待どおりに機能する能力を指します。
誤った回答:
B: 持続可能性は、どのような状況でも失敗しないように、状況に応じて制御が変化することを保証します。
したがって、これは有効な回答ではありません。
C: これは有効な回答ではありません。
D: これはツールの持続可能性を定義するための有効な定義ではありません。

Residual risk is the risk that remains after the risk mitigation plans have been implemented. Residual risk reflects the effectiveness of the risk response in reducing the likelihood or impact of the risk. The best evidence that risk mitigation plans have been implemented effectively is the change in the level of residual risk. A change in the level of residual risk can be measured by comparing the risk level before and after the risk mitigation plans have been executed. A change in the level of residual risk can also be evaluated by comparing the actual residual risk with the target or acceptable residual risk. A change in the level of residual risk can demonstrate how well the risk mitigation plans have achieved the risk objectives and met the risk criteria. A change in the level of residual risk can also provide feedback and lessons learned for future risk management activities. References = Residual Risk: Definition, Formula & Management, Residual Risk: What It Is and How to Manage It, Residual Risk: How to Calculate and Manage It.