The primary basis for prioritizing risk responses is the impact of the risk. The impact of the risk is the consequence or effect of the risk on the organization's objectives or operations, such as financial loss, reputational damage, operational disruption, or legal liability. The impact of the risk is one of the key dimensions of risk analysis, along with the likelihood of the risk. The impact of the risk helps to determine the severity and priority of the risk, and to select the most appropriate and effective risk response. The impact of the risk also helps to evaluate the cost-benefit and trade-off of the risk response, and to measure the residual risk and the risk performance. The other options are not the primary basis for prioritizing risk responses, although they may be considered or influenced by the impact of the risk. The replacement cost of the business asset, the cost of risk mitigation controls, and the classification of the business asset are all factors that could affect the value or importance of the business asset, but they do not necessarily reflect the impact of the risk on the business asset or the organization. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.1, page 4-25.

Section: Volume D
Explanation:
For effective communication, information communicated should not inundate the recipients. All ground rules of good communication apply to communication on risk. This includes the avoidance of jargon and technical terms regarding risk because the intended audiences are generally not deeply technologically skilled. Hence use of technical terms is avoided for effective communication Incorrect Answers:
A, C, D: These all are true for effective risk communication. For effective risk communication the risk information should be clear, concise, useful and timely. Risk information must be known and understood by all the stakeholders. Information or communication should not overwhelm the recipients. This includes the avoidance of technical terms regarding risk because the intended audiences are generally not much technologically skilled.
Any communication on risk must be relevant. Technical information that is too detailed or is sent to inappropriate parties will hinder, rather than enable, a clear view of risk. For each risk, critical moments exist between its origination and its potential business consequence.
Information should also be aimed at the correct target audience and available on need-to-know basis. Hence for effective risk communication risk information should be:
* Clear
* Concise
* Useful
* Timely given
* Aimed at the correct audience
* Available on need-to-know basis

* Key risk indicator (KRI): A metric that measures the level of risk exposure or the likelihood of a risk event1.
* KRI threshold: A predefined value or range that triggers an alert or action when the KRI reaches or exceeds it2.
* Loss expectancy: The estimated amount of loss that an organization may incur due to a risk event3.
The most helpful thing in developing KRI thresholds is loss expectancy information. Loss expectancy information provides an estimate of the potential or expected impact of a risk event on the organization's operations, reputation, or objectives. Loss expectancy information can help an organization to:
* Quantify and prioritize the risks that pose the greatest threat to the organization
* Determine the acceptable level of risk exposure or tolerance for each risk
* Set the appropriate value or range for the KRI threshold that reflects the risk appetite and the risk mitigation strategy
* Monitor and measure the performance and effectiveness of the risk management process and controls Loss expectancy information can be derived from various sources, such as historical data, statistical analysis, expert judgment, or simulation models3.
The other options are not as helpful as loss expectancy information in developing KRI thresholds, because they do not directly address the potential or expected impact of a risk event. Control performance predictions, which are the forecasts or estimates of how well the risk management controls will perform in preventing, detecting, or mitigating risks, may help to evaluate the adequacy and efficiency of the risk management process and controls, but they do not provide a clear and quantifiable measure of the risk impact. IT service level agreements (SLAs), which are the contracts or agreements that define the quality and availability of IT services, may help to establish the standards and expectations for IT service delivery and performance, but they do not provide a comprehensive and current view of the risk exposure or likelihood. Remediation activity progress, which is the status or outcome of the actions taken to address and resolve a risk event, may help to monitor and report the effectiveness and compliance of the risk management process and controls, but it is usually done after the risk event has occurred and resolved, not before.
References = Key Risk Indicators: Definition, Examples, and Best Practices, KRI Framework for Operational Risk Management | Workiva, Loss Expectancy: Definition, Calculation, and Examples