Explanation/Reference:
Explanation:
As quantitative analysis is data driven, it:
Allows data classification and counting.

Allows statistical models to be constructed, which help in explaining what is being observed.

Generalizes findings for a larger population and direct comparisons between two different sets of data

or observations.
Produces statistically reliable results.

Allows discovery of phenomena which are likely to be genuine and merely occurs by chance.

Incorrect Answers:
A: Risk factors are expressed in terms of high/medium/low in qualitative analysis, and not in quantitative analysis.

The situation that presents the greatest challenge to creating a comprehensive IT risk profile of an organization is having inaccurate documentation of enterprise architecture (EA). EA is the blueprint that describes the structure and operation of an organization, including its business processes, information systems, technology infrastructure, and governance. EA helps to align the IT strategy and objectives with the business strategy and objectives, and to identify and manage the IT risks and opportunities. Having inaccurate documentation of EA could lead to incomplete, inconsistent, or misleading information about the organization's IT environment, which could affect the quality and reliability of the IT risk profile. The other situations are not as challenging as having inaccurate documentation of EA, although they may also pose some difficulties or limitations for the IT risk profile. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.1, page 2-12.

B, and C are incorrect. These all are true for KRIs. Key Risk Indicators are the prime monitoring indicators of the enterprise. KRIs are highly relevant and possess a high probability of predicting or indicating important risk. KRIs help in avoiding excessively large number of risk indicators to manage and report that a large enterprise may have. The complete set of KRIs should also balance indicators for risk, root causes and business impact, so as to indicate the risk and its impact completely.

Section: Volume D