is incorrect. Delphi technique is used for risk analysis, i.e., for identifying the most probable risks. Delphi is a group of experts who used to rate independently the business risk of an organization. Each expert analyzes the risk independently and then prioritizes the risk, and the result is combined into a consensus. Answer: A is incorrect. Project network diagrams help the project manager and stakeholders visualize the flow of the project work, but they are not used as a part of risk response planning. Answer: B is incorrect. Cause-and-effect analysis is used for exposing risk factors and not an effective one in risk response planning. This analysis involves the use of predictive or diagnostic analytical tool for exploring the root causes or factors that contribute to positive or negative effects or outcomes.

Section: Volume D
Explanation:
A risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to these threats. A risk from an organizational perspective consists of:
* Threats to various processes of organization.
* Threats to physical and information assets.
* Likelihood and frequency of occurrence from threat.
* Impact on assets from threat and vulnerability.
* Risk analysis allows the auditor to do the following tasks :
* Threats to various processes of organization.
* Threats to physical and information assets.
* Likelihood and frequency of occurrence from threat.
* Impact on assets from threat and vulnerability.
* Risk analysis allows the auditor to do the following tasks :
* Identify threats and vulnerabilities to the enterprise and its information system.
* Provide information for evaluation of controls in audit planning.
* Aids in determining audit objectives.
* Supporting decision based on risks.
Incorrect Answers:
B: Auditors identify threats and vulnerability not only in the IT but the whole enterprise as well.

is incorrect. The CPI value of 1 indicates that the project is right on target.