Section: Volume A
Explanation:
Since the enterprise's internal and external environments are constantly changing, the risk environment is also highly dynamic, i.e., threats and vulnerabilities change over time. Hence KRIs need to be maintained to ensure that KRIs continue to effectively capture these changes.
Incorrect Answers:
A: Timely risk reporting is one of the business requirements, but is not the reason behind KRI maintenance.
B: While most key risk indicator metrics need to be optimized in respect to their sensitivity, the most important objective of KRI maintenance is to ensure that KRIs continue to effectively capture the changes in threats and vulnerabilities over time.
D: Avoiding risk is a type of risk response. Risk responses are based on KRI reporting.

The most important factor for senior management to review during an acquisition is the risk appetite and tolerance of the target organization. The risk appetite and tolerance reflect the amount and type of risk that an organization is willing to accept in pursuit of its objectives. By reviewing the risk appetite and tolerance of the target organization, senior management can determine if they are compatible with their own, and if the acquisition will create any significant risk exposure or opportunity for the acquiring organization. Risk framework and methodology, key risk indicator (KRI) thresholds, and risk communication plan are other factors that may be reviewed, but they are not as important as the risk appetite and tolerance. References
= ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 8; CRISC Review Manual, 6th Edition, page 97.

Risk appetite is defined as "the amount of risk that an organization is willing to accept in pursuit of its objectives, before action is deemed necessary to reduce the risk."1 It represents a balance between the potential benefits of innovation and the threats that change inevitably brings. Risk appetite reflects the organization's risk attitude and its willingness to accept risk in specific scenarios, with a governance model in place for risk oversight. Risk appetite helps to guide the organization's approach to risk and risk management, and to align its risk decisions with its business objectives and context. The other options are not the best descriptions of risk appetite, as they are either too vague (the effective management of risk and internal control environments), too narrow (acceptable variation between risk thresholds and business objectives), or confusing (the acceptable variation relative to the achievement of objectives). References = Risk Appetite vs. Risk Tolerance: What is the Difference?