Section: Volume C
Explanation:
The result of risk analysis process is being communicated to relevant stakeholders. The steps that are involved in communication are:
* The results should be reported in terms and formats that are useful to support business decisions.
* Coordinate additional risk analysis activity as required by decision makers, like report rejection and scope adjustment.
* Communicate the risk-return context clearly, which include probabilities of loss and/or gain, ranges, and confidence levels (if possible) that enable management to balance risk-return.
* Identify the negative impacts of events that drive response decisions as well as positive impacts of events that represent opportunities which should channel back into the strategy and objective setting process.
* Provide decision makers with an understanding of worst-case and most probable scenarios, due diligence exposures and significant reputation, legal or regulatory considerations.
Incorrect Answers:
B: Both the negative and positive risk impacts are being communicated to relevant stakeholders. Identify the negative impacts of events that drive response decisions as well as positive impacts of events that represent opportunities which should channel back into the strategy and objective setting process.

Section: Volume D
Explanation/Reference:

Section: Volume D

* Reporting to the Risk Committee:
* Role of Risk Committee: The risk committee is responsible for overseeing the organization's risk management practices, including identifying, assessing, and mitigating risks.
* Emerging IT Risks: Reporting emerging IT risk scenarios to the committee ensures that new and
* evolving threats are identified and addressed proactively.
* Importance of Emerging IT Risk Scenarios:
* Proactive Risk Management: By staying informed about emerging risks, the committee can implement preventive measures and avoid potential impacts.
* Strategic Planning: Understanding emerging risks allows for better strategic planning and resource allocation to address these risks.
* Comparison with Other Options:
* System Risk and Control Matrix: Useful for ongoing monitoring but may not capture new and emerging risks.
* Changes to Risk Assessment Methodology: Important for refining risk management processes but not as critical as identifying new risks.
* Audit Committee Charter: Relevant for governance but not directly related to proactive risk management.
* Best Practices:
* Regular Updates: Provide the risk committee with regular updates on emerging IT risk scenarios.
* Collaborative Approach: Engage various stakeholders in identifying and reporting emerging risks.
References:
* CRISC Review Manual: Highlights the importance of monitoring and reporting emerging IT risks to ensure effective risk management .
* ISACA Guidelines: Stress the need for continuous risk assessment and reporting to keep the risk committee informed of new threats .

Explanation/Reference:
Explanation:
A quantitative risk assessment quantifies risk in terms of numbers such as dollar values. This involves gathering data and then entering it into standard formulas. The results can help in identifying the priority of risks. These results are also used to determine the effectiveness of controls. Some of the terms associated with quantitative risk assessments are:
Single loss expectancy (SLE)-It refers to the total loss expected from a single incident. This incident

can occur when vulnerability is being exploited by threat. The loss is expressed as a dollar value such as $1,000. It includes the value of data, software, and hardware. SLE = Asset value * Exposure factor Annual rate of occurrence (ARO)-It refers to the number of times expected for an incident to occur in a

year. If an incident occurred twice a month in the past year, the ARO is 24. Assuming nothing changes, it is likely that it will occur 24 times next year. Annual loss expectancy (ALE)-It is the expected loss for a year. ALE is calculated by multiplying SLE with ARO. Because SLE is a given in a dollar value, ALE is also given in a dollar value. For example, if the SLE is $1,000 and the ARO is 24, the ALE is $24,000.
ALE = SLE * ARO Safeguard value-This is the cost of a control. Controls are used to mitigate risk. For

example, antivirus software of an average cost of $50 for each computer. If there are 50 computers, the safeguard value is $2,500. A, B, C: These are wrong formulas and are not used in quantitative risk assessment.