Explanation/Reference:
Explanation:
The primary objective of a security review or audit should be to provide assurance on the adequacy of security controls. Reviews should focus on all forms of control, not just on preventive control. Cost- effectiveness and technological currency are important but not as critical.

Explanation
According to the CISM Review Manual, key risk indicators (KRIs) are the most important information to include in an information security status report to senior management, as they provide a measure of the current level of risk exposure and the effectiveness of the risk management activities. KRIs also help to identify trends, patterns and emerging risks that may require management attention or action.
References = CISM Review Manual, 27th Edition, Chapter 4, Section 4.3.2, page 209

Explanation
The information security manager should compare the level of residual risk with the organization's risk appetite to inform a risk treatment decision. Residual risk is the risk that remains after applying the risk treatment options, such as avoiding, transferring, mitigating, or accepting the risk. Risk appetite is the amount of risk that the organization is willing to accept to achieve its objectives. The information security manager should ensure that the residual risk is within the risk appetite, and if not, apply additional risk treatment measures or escalate the risk to the senior management for approval.
References = CISM Review Manual, 16th Edition eBook1, Chapter 2: Information Risk Management, Section:
Risk Management, Subsection: Risk Treatment, Page 102.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT