Section: Volume C
Explanation:
Risk cannot be removed completely from the enterprise; it can only be reduced to a level that an organization is willing to accept. Risk management programs are hence designed to accomplish the task of reducing risks.
Incorrect Answers:
B: Depending on the risk preference of an enterprise, it may or may not choose to pursue risk mitigation to the point at which benefit equals or exceeds the expense. Hence this is not the primary objective of designing the risk management program.
C: Reducing risk to a level too small to measure is not practical and is often cost-prohibitive.
D: Reducing risks to a specific return ignores the qualitative aspects of the risk which should also be considered.

Section: Volume D

Section: Volume B
Explanation:
Profitability operational risks focus on the financial risks which encompass providing a quality product that is cost-effective in production. It ensures that the provision of a quality product is not overshadowed by the production costs of that product.
Incorrect Answers:
A: Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. Information security risks are the risks that are associated with the protection of these information and information systems.
B: These risks do not ensure that the provision of a quality product is not overshadowed by the production costs of that product.
C: Project activity risks are not associated with provision of a quality product or the production costs of that product.

is incorrect. This is not a valid answer.