Key risk indicators (KRIs) are metrics that provide information on the level of exposure to a given risk. They enable ongoing monitoring of emerging risk by alerting the organization when the risk level exceeds the predefined threshold or tolerance. By using KRIs, the organization can track the changes in the risk environment and take timely and appropriate actions to mitigate or avoid the risk.
Helping an organization identify emerging threats, benchmarking the organization's risk profile, and identifying trends in the organization's vulnerabilities are all possible uses of KRIs, but they are not the primary benefit. The primary benefit is to enable ongoing monitoring of emerging risk, which encompasses all these aspects and more. References = CRISC Review Manual, 7th Edition, ISACA, 2020, page 27-281

Section: Volume B
Explanation:
Risk is an uncertain event or condition that, if it occurs, has an effect on at least one project objective.
Project risk is concerned with the expected value of one or more results of one or more future events in a project. It is an uncertain condition that, if it occurs, has an effect on at least one project objective. Objectives can be scope, schedule, cost, and quality. Project risk is always in the future.
Incorrect Answers:
A: Risk is not unknown, it is uncertain; in addition, the event can affect at least one project objective - not just the project scope.
B: This statement is almost true, but the event does not have to happen within project execution.
C: Risks can affect time, costs, or scope, rather affecting only cost.

Assessing the threat and associated impact is the next thing that a risk practitioner should do after learning that Internet of Things (IoT) devices installed in the production environment lack appropriate security controls for sensitive data. This is because assessing the threat and associated impact can help determine the level and nature of the risk posed by the IoT devices, as well as the potential consequences and costs of a security breach or incident. Assessing the threat and associated impact can also provide the basis for further risk analysis and response steps, such as evaluating risk appetite and tolerance levels, recommending device management controls, or enabling role-based access control. According to the CRISC Review Manual 2022, assessing the threat and associated impact is one of the key steps in the IT risk assessment process1. According to the web search results, assessing the threat and associated impact is a common and recommended practice for addressing the security risks of IoT devices