Section: Volume A
Explanation:
If the costs of specific controls or countermeasures (control overhead) exceed the benefits of mitigating a given risk the enterprise may choose to accept the risk rather than incur the cost of mitigation. This is done according to the principle of proportionality described in:
* Generally accepted security systems principles (GASSP)
* Generally accepted information security principles (GAISP)
Incorrect Answers:
A: When the cost of specific controls exceeds the benefits of mitigating a given risk, then controls are not applied, rather risk is being accepted.
B: As the cost of control exceeds the benefits of mitigating a given risk, hence no control should be applied.
Corrective control is a type of control and hence it should not be adopted.
D: The risk is being exploited when there is an opportunity, i.e., the risk is positive. But here in this case, negative risk exists as it needs mitigation. So, exploitation cannot be done.

The most effective method for uniquely identifying the originator of electronic transactions is a digital signature. A digital signature is a cryptographic technique that uses a pair of keys, one public and one private, to authenticate the identity and integrity of the sender and the message. A digital signature is created by applying the sender's private key to a hash of the message, and is verified by applying the sender's public key to the signature and comparing it with the hash of the message. A digital signature ensures that the sender cannot deny sending the message (non-repudiation), and that the message has not been altered or tampered with during transmission (data integrity). References = Risk and Information Systems Control Study Manual,
7th Edition, Chapter 3, Section 3.2.3, page 1301

* Key risk indicators (KRIs) are metrics that provide information about the level of exposure to a specific risk or a group of risks.
* The most important data attribute of KRIs is that the data is relevant. This means that the data reflects the current state of the risk, the potential impact of the risk, and the effectiveness of the risk response.
Relevant data helps to monitor and measure the risk performance and to make informed decisions about risk management.
* The other options are not the most important data attributes of KRIs. They are either secondary or not essential for KRIs.
The references for this answer are:
* Risk IT Framework, page 15
* Information Technology & Security, page 9
* Risk Scenarios Starter Pack, page 7

Section: Volume C
Explanation/Reference:

The best approach to identify relevant risk scenarios is to engage line management in risk assessment workshops. Risk scenarios are hypothetical situations that describe how a risk event could occur and what the consequences could be1. Identifying risk scenarios can help to understand and communicate the nature and impact of the risks, and to design and evaluate the risk responses2. To identify relevant risk scenarios, it is important to involve the people who are responsible for or affected by the risks, such as the line managers. Line managers are the managers who oversee the operational activities and processes of the organization, and who report to the senior or executive management3. By engaging line managers in risk assessment workshops, the organization can:
* Leverage the line managers' knowledge and experience of the operational environment, the business objectives, the stakeholder expectations, and the potential threats and opportunities4.
* Encourage the line managers' participation and collaboration in the risk identification and analysis process, and foster a risk-aware culture and mindset5.
* Enhance the line managers' ownership and accountability of the risks and the risk responses, and ensure their alignment and commitment to the risk management strategy and objectives6.
The other options are not the best approaches to identify relevant risk scenarios, because:
* Escalating the situation to risk leadership is not an effective or efficient way to identify risk scenarios, as it may bypass or undermine the line managers' role and responsibility in the risk management process. Risk leadership is the function or role that provides the vision, direction, and guidance for the risk management activities and initiatives of the organization7. Escalating the situation to risk leadership may imply that the line managers are not capable or willing to identify and manage the risks, or that the risk leadership is not aware or involved in the risk management process. This may create confusion, conflict, or distrust among the risk management stakeholders, and reduce the quality and credibility of the risk scenarios.
* Engaging internal audit for risk assessment workshops is not a suitable or appropriate way to identify risk scenarios, as it may violate the independence and objectivity of the internal audit function. Internal audit is an independent and objective assurance and consulting activity that evaluates and improves the effectiveness of the organization's governance, risk management, and control processes8. Engaging internal audit for risk assessment workshops may compromise the internal audit's role and mandate, as it may create a conflict of interest or a self-review threat. Internal audit should not be involved in the risk identification and analysis process, but rather provide assurance or advice on the adequacy and reliability of the process.
* Reviewing system and process documentation is not a sufficient or comprehensive way to identify risk scenarios, as it may overlook or miss some important or emerging risks. System and process documentation are the records or artifacts that describe the structure, functions, features, and requirements of the organization's systems and processes. Reviewing system and process documentation can help to identify some risks that are related to the design, implementation, or operation of the systems and processes, but it cannot capture all the risks that may affect the organization. Some risks may arise from external or internal factors that are not reflected or updated in the system and process documentation, such as changes in the market, technology, regulation, or stakeholder expectations.
References =
* Risk Scenarios Toolkit - ISACA
* Risk Scenarios Starter Pack - ISACA
* Line Manager - CIO Wiki
* Engaging Line Managers in Risk Management - IRM
* Risk Culture - CIO Wiki
* Risk Ownership - CIO Wiki
* Risk Leadership - CIO Wiki
* Internal Audit - CIO Wiki
* [System Documentation - CIO Wiki]