Section: Volume C
Explanation:
Among the given choices only Acceptance response is used for negative risk events. Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. If an enterprise adopts a risk acceptance, it should carefully consider who can accept the risk. Risk should be accepted only by senior management in relationship with senior management and the board. There are two alternatives to the acceptance strategy, passive and active.
* Passive acceptance means that enterprise has made no plan to avoid or mitigate the risk but willing to accept the consequences of the risk.
* Active acceptance is the second strategy and might include developing contingency plans and reserves to deal with risks.
Incorrect Answers:
A, B, C: These all are used to deal with opportunities or positive risks, and not with negative risks.

セクション: 巻 C
Explanation:
リスクは企業から完全に排除することはできません。組織が受け入れるレベルまでリスクを軽減することしかできません。したがって、リスク管理プログラムはリスクを軽減するタスクを達成するために設計されています。
誤った回答:
B: 企業のリスク選好に応じて、利益が費用と同等かそれを上回るまでリスク軽減を追求するかどうかは企業によって選択されます。したがって、これはリスク管理プログラムを設計する主な目的ではありません。
C: リスクを測定できないほど小さいレベルまで減らすことは現実的ではなく、多くの場合、コストがかかりすぎます。
D: 特定のリターンに対してリスクを減らすことは、考慮すべきリスクの質的側面を無視することになります。

The MOST critical requirement to include in the contract is the confidentiality of customer data, because it is a legal and ethical obligation of the bank to protect the privacy and security of its customers' personal and financial information. Outsourcing the statement printing function to an external service provider exposes the customer data to potential unauthorized access, disclosure, or misuse by the service provider or its sub-contractors. Therefore, the contract should specify the terms and conditions for the handling, storage, and disposal of the customer data, as well as the penalties for any breach of confidentiality. The other options are not as critical as the confidentiality of customer data, because:
* Option A: Monitoring of service costs is an important requirement to ensure that the service provider delivers the statement printing function within the agreed budget and scope, but it is not as critical as the confidentiality of customer data, which has legal and reputational implications for the bank.
* Option B: Provision of internal audit reports is a useful requirement to verify that the service provider complies with the internal and external standards and regulations for the statement printing function, but it is not as critical as the confidentiality of customer data, which is a core value of the bank and its customers.
* Option C: Notification of sub-contracting arrangements is a relevant requirement to ensure that the service provider does not delegate the statement printing function to another party without the bank's consent and oversight, but it is not as critical as the confidentiality of customer data, which is the primary responsibility of the bank and its service provider. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 197.

統制の有効性とは、プロセスまたはアクティビティにおける重大な虚偽表示またはエラーのリスクを軽減するという本来の目的をどれだけ達成しているかを指します2。統制の有効性を測定する方法の 1 つは、検出された統制逸脱の数を監視することです。統制逸脱とは、統制が設計どおりに機能しなかったり、一貫して正しく適用されなかったりするケースです3。統制逸脱の数が多いと、統制の有効性が低いことを示し、統制逸脱の数が少ないと、統制の有効性が高いことを示します。その他のオプションは、統制のパフォーマンスや結果に直接関係しないため、統制の有効性を示す良い指標ではありません。統制の対象範囲、許可された例外の数、およびプロセスを実行するために必要な手順の数は、統制の有効性ではなく、統制の設計または効率に関連します。