The objective of aligning mitigating controls to risk appetite is to ensure that the cost of controls does not exceed the expected loss. The cost of controls is the amount of resources and efforts required to implement and maintain the controls that are designed to reduce the risk exposure. The expected loss is the estimated amount of loss or harm that may result from a risk event. The risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. By aligning mitigating controls to risk appetite, the organization can optimize the balance between the cost of controls and the expected loss, and avoid over- or under-investing in controls. Exposures being reduced to the fullest extent, exposures being reduced only for critical business systems, and insurance costs being minimized are other possible objectives, but they are not as relevant as the cost of controls not exceeding the expected loss. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 8; CRISC Review Manual, 6th Edition, page 97.

Section: Volume C
Explanation:
Integrated change control is the component that is responsible for reviewing all aspects of a change's impact on a project - including risks that may be introduced by the new change.
Integrated change control is a way to manage the changes incurred during a project. It is a method that manages reviewing the suggestions for changes and utilizing the tools and techniques to evaluate whether the change should be approved or rejected. Integrated change control is a primary component of the project's change control system that examines the affect of a proposed change on the entire project.
Incorrect Answers:
A: Configuration management controls and documents changes to the features and functions of the product scope.
B: Scope change control focuses on the processes to allow changes to enter the project scope.
C: Risk monitoring and control is not part of the change control system, so this choice is not valid.

* A change management process is a set of procedures and activities that ensure that any changes to the IT systems or applications are planned, approved, tested, implemented, and documented in a consistent and controlled manner.
* A change management process has recently been updated with new testing procedures. This means that the process has been improved or modified to include new or additional steps or methods for verifying and validating the changes before they are deployed to the production environment.
* The next course of action after updating the change management process with new testing procedures is
* to communicate to those who test and promote changes. This means that the change management team or function should inform and educate the people who are involved or affected by the changes, such as the developers, testers, users, customers, etc., about the new testing procedures, their purpose, benefits, requirements, and expectations.
* Communicating to those who test and promote changes helps to ensure that the new testing procedures are understood and followed by all the parties, that the changes are tested and promoted in accordance with the process standards and criteria, and that the changes are delivered with the expected quality and performance.
* The other options are not the next courses of action after updating the change management process with new testing procedures. They are either secondary or not essential for change management.
The references for this answer are:
* Risk IT Framework, page 27
* Information Technology & Security, page 21
* Risk Scenarios Starter Pack, page 19

According to the CRISC Review Manual, an enterprise-wide ethics training and awareness program is one of the key elements of a strong risk culture, as it helps to promote ethical behavior, raise awareness of risk management principles and practices, and foster a culture of accountability and transparency2
1: Developing Collective Risk Leadership Through CRISC - ISACA 2: CRISC Review Manual, 7th Edition, page 23