CRISC Certified in Risk and Information Systems ControlGovernanceMedium
A technology startup is rapidly developing a new social media application. The founders are highly focused on market penetration and user acquisition, often deprioritizing formal risk assessments and compliance activities to accelerate development. This approach has led to several minor data privacy incidents and a growing backlog of security vulnerabilities. Which of the following governance elements is MOST lacking in this organization's approach?
- AA comprehensive incident response plan.
- BAn established risk appetite statement.
- CRegular external audits.
- DDefined roles and responsibilities for risk management.
Show answer & explanationAnswer & explanation
Correct answer: B. An established risk appetite statement.
The scenario describes an organization that is implicitly taking on significant risk without formally acknowledging or communicating its tolerance. An established risk appetite statement would define the level of risk the organization is willing to accept to achieve its objectives, providing a crucial framework for prioritizing risk assessments and compliance activities. Without it, decisions are ad-hoc and reactive.
Why the other options are wrong
- A. An incident response plan is reactive and addresses the aftermath of incidents, not the proactive governance of risk acceptance.
- C. External audits are important for assurance but do not define the organization's fundamental stance on risk-taking.
- D. While important, defining roles and responsibilities for risk management would be guided by, or help to establish, a risk appetite, rather than being the fundamental missing element here.
Risk Appetite Statement
A formal statement articulating the amount and type of risk an organization is willing to accept, retain, or take in pursuit of its objectives.
- Guides strategic decision-making.
- Sets boundaries for risk-taking.
- Communicates risk tolerance to stakeholders.
Memory trick: Without a 'Risk Appetite Map', the startup is sailing blind in a risky sea.