In which of the following cases, would an organization be more prone to risk acceptance vs. risk mitigation?

The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because_______________.

The ability to demand the implementation and management of security controls on third parties providing services to an organization is_________________________.

Which of the following is considered a project versus a managed process?

An international organization is planning a project to implement encryption technologies to protect company confidential information. This organization has data centers on three continents. Which of the following would be considered a MAJOR constraint for the project?