Risk is inefficiently controlled when the annual cost of the control exceeds the annual loss expectancy (ALE) of the risk, as this means that the organization is spending more on the control than the potential loss that the control is supposed to prevent or reduce. This indicates that the control is not cost-effective or optimal, and that the organization should consider alternative or complementary controls that can lower the cost or increase the benefit of the risk management. Control is ineffective and should be strengthened when the control does not reduce the likelihood or impact of the risk to an acceptable level, regardless of the cost. Risk is efficiently controlled when the annual cost of the control is equal to or less than the annual loss expectancy (ALE) of the risk, as this means that the organization is spending less or equal on the control than the potential loss that the control is supposed to prevent or reduce. Control is weak and should be removed when the control does not provide any benefit or value to the risk management, regardless of the cost. References = CRISC Certified in Risk and Information Systems Control - Question205; ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 205.

Section: Volume D
Explanation:
The cost management plan is an input to the quantitative risk analysis process because of the cost management control it provides.
The cost management plan sets how the costs on a project are managed during the project's life cycle. It defines the format and principles by which the project costs are measured, reported, and controlled. The cost management plan identifies the person responsible for managing costs, those who have the authority to approve changes to the project or its budget, and how cost performance is quantitatively calculated and reported upon.
Incorrect Answers:
B: The cost management plan defines the estimating, budgeting, and control of the project's cost.
C: While the cost management plan does define the cost change control system, this is not the best answer for this D: This is not a valid statement. The cost management plan is an input to the quantitative risk analysis process.

Section: Volume B
Explanation:
The International Organization for Standardization (ISO) identifies the following principles of risk management.
Risk management should:
* create value
* be an integral part of organizational processes
* be part of decision making
* explicitly address uncertainty
* be systematic and structured
* be based on the best available information
* be tailored
* take into account human factors
* be transparent and inclusive
* be dynamic, iterative, and responsive to change
* be capable of continual improvement and enhancement

Section: Volume D

The management action that will most likely change the likelihood rating of a risk scenario related to remote network access is implementing multi-factor authentication. Multi-factor authentication is a technique that requires the user to provide two or more pieces of evidence to verify their identity, such as a password, a token, or a biometric factor. Multi-factor authentication can help to reduce the likelihood of unauthorized or malicious access to the remote network, as it adds an extra layer of security and makes it harder for the attackers to compromise the user credentials. The other options are not as likely to change the likelihood rating of the risk scenario, as they are related to the update, creation, or maintenance of the remote network access, not the verification or protection of the remote network access. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Response, Section 3.3: IT Risk Response Implementation, page 145.