An enterprise is developing an ethics program, and the ethical standards have been defined. Which of the following should the enterprise do NEXT?

1. A. Establish a training and awareness program focused on ethics.
2. B. Implement an enterprise-wide employee monitoring program.
3. C. Develop key performance indicators (KPIs) for program implementation.
4. D. Outline and document consequences for noncompliance.

Correct Answer: C

Which of the following is the PRIMARY purpose of an effective set of key risk indicators (KRIs)?

1. A. Identifying possible future adverse impacts on the enterprise
2. B. Evaluating existing technology for risk monitoring capabilities
3. C. Establishing executive level buy-in of the risk program
4. D. Quantifying the productivity of the risk management team

Correct Answer: A

In which of the following situations is it MOST appropriate to use a quantitative risk assessment?

1. A. There is a lack of accurate and reliable past and present risk data.
2. B. The risk assessment needs to be completed in a short period of time.
3. C. The objectivity of the risk assessment is of primary importance.
4. D. The risk assessment is needed for an IT project business case.

Correct Answer: C

An enterprise wishes to establish key risk indicators (KRIs) in an effort to better manage IT risk. Which of the following should be identified FIRST?

1. A. Risk mitigation strategies
2. B. Enterprise architecture (EA) components
3. C. The enterprise risk appetite
4. D. Key performance metrics

Correct Answer: C

An enterprise is concerned with the potential for data leakage as a result of increased use of social media in the workplace, and wishes to establish a social media strategy. Which of the following should be the MOST important consideration in developing this strategy?

1. A. Criticality of the information
2. B. Ensuring that the enterprise architecture (EA) is updated
3. C. Data ownership
4. D. The balance between business benefits and risk

Correct Answer: A