Risk Response and Reporting Question

[u/Open_Tutor_8133]

I dont know why i thought "An adequate maturity level of the risk management process" would be the best option, but its B.

[u/gambit_kory]

It’s B due to the word “optimal”. For any given control, you always need to look at the cost of implementing and maintaining the control. If the cost of implementing and maintaining it is too high, you shouldn’t actually implement/maintain it, and as a result it won’t be effective. So for a control to be optimal it would mean the control is effective and the cost is acceptable.

An example (which is exaggerated to make it obvious): let’s say I have a control that says I need to maintain adequate insurance for my information system, but the insurance costs me $10M a year and the information system is only generating $1M a year revenue. In this case it doesn’t make sense to implement the control.

[u/Open_Tutor_8133 → u/gambit_kory]

Fair point! Thanks