Section: Volume D

Explanation/Reference:
Explanation:
Blame culture should be avoided. It is the most effective inhibitor of relevant and efficient communication.
In a blame culture, business units tend to point the finger at IT when projects are not delivered on time or do not meet expectations. In doing so, they fail to realize how the business unit's involvement up front affects project success. In extreme cases, the business unit may assign blame for a failure to meet the expectations that the unit never clearly communicated. Executive leadership must identify and quickly control a blame culture if collaboration is to be fostered throughout the enterprise.
Incorrect Answers:
A: This is the consequence of poor risk communication, not the inhibitor of effective communication.
B: This is the consequence of poor risk communication, not the inhibitor of effective communication.
D: Misalignment between real risk appetite and translation into policies is an inhibitor of effective communication, but is not a prominent as existence of blame culture.

After entering a large number of low-risk scenarios into the risk register, it is most important for the risk practitioner to analyze changes to aggregate risk. Aggregate risk is the total amount and type of risk that the organization faces or accepts, considering all the individual and interrelated risk scenarios. Aggregate risk helps to measure and monitor the organization's risk profile, risk appetite, and risk performance, and to support the risk decision-making and reporting processes. Analyzing changes to aggregate risk is important after entering a large number of low-risk scenarios, because even though the individual risk scenarios may have low likelihood or impact, they may still have a significant cumulative or combined effect on the organization's objectives or operations. Analyzing changes to aggregate risk also helps to identify and prioritize the most critical or relevant risk scenarios, and to select the most appropriate and effective risk responses and strategies. The other options are not as important as analyzing changes to aggregate risk, although they may be part of or derived from the risk analysis process. Preparing a follow-up risk assessment, recommending acceptance of the risk scenarios, and reconfirming risk tolerance levels are all activities that can help to implement or update the risk management process, but they are not the most important after entering a large number of low-risk scenarios. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.1, page 4-25.

= Change management is the process of planning, implementing, and monitoring changes to IT systems, services, or infrastructure in a controlled and coordinated manner1. Change management controls are the policies, procedures, and tools that ensure changes are authorized, documented, tested, and reviewed before they are deployed to the production environment2.
Change-related exceptions are the deviations or violations from the established change management controls, such as unauthorized, untested, or failed changes3. Change-related exceptions pose a high risk to the organization, as they can cause system instability, performance degradation, security breaches, data loss, or compliance issues3.
An increase in change-related exceptions per month would be the greatest concern for an IT risk practitioner, as it indicates a lack of effectiveness, efficiency, or compliance of the change management process and controls. An increase in change-related exceptions per month could result from:
* Poor change planning, prioritization, or scheduling
* Insufficient change approval, review, or communication
* Inadequate change testing, validation, or verification
* Lack of change monitoring, reporting, or auditing
* Low change awareness, training, or support
An IT risk practitioner should investigate the root causes of the increase in change-related exceptions per month, and recommend corrective and preventive actions to improve the change management process and controls, such as:
* Aligning the change management process with the organization's goals, strategies, and risk appetite
* Implementing a standardized and consistent change management methodology, such as ITIL or COBIT
* Defining clear roles and responsibilities for change management stakeholders, such as change owners, change managers, change advisory boards, change implementers, and change users
* Establishing clear and measurable criteria and thresholds for change authorization, classification, and evaluation
* Leveraging tools and technologies to automate and streamline the change management process and controls, such as change management software, configuration management databases, or change management dashboards
* Enhancing the change management culture and capabilities, such as change management awareness, training, support, or feedback The other options are not as concerning as an increase in change-related exceptions per month, because they do not directly imply a risk to the organization's IT systems, services, or infrastructure. Rolled back changes below management's thresholds, which are the changes that are reversed or undone due to errors, defects, or issues, may indicate a need for improvement in the change testing, validation, or verification processes, but they do not necessarily cause harm or damage to the production environment, as long as they are within the acceptable limits set by the management. The average implementation time for changes, which is the duration of the change deployment process, may affect the organization's agility, efficiency, or productivity, but it does not necessarily compromise the quality, security, or reliability of the changes, as long as they are implemented according to the change management controls. The number of user stories approved for implementation, which are the requirements or features that are expressed from the perspective of the end users, may reflect the organization's demand, innovation, or customer satisfaction, but it does not necessarily increase the risk of the changes, as long as they are managed and controlled by the change management process.
References = What is Change Management? | ITIL | AXELOS, Change Management Controls: Definition, Types, and Best Practices, Change Management Exceptions: Definition, Causes, and Impacts, ITIL Change Management: Best Practices & Processes - BMC Software, COBIT 2019: Change Enablement

Section: Volume D