A risk practitioner is asked to demonstrate that the IT risk management approach supports the organisation's strategy. Which action provides the strongest evidence of strategic alignment?
- ADeriving risk appetite, tolerance and treatment priorities directly from the approved strategic objectives Correct
- BMapping each identified IT risk scenario to the specific business objectives it could impair
- CCounting how many IT risk scenarios were closed within the agreed remediation window
- DPublishing the IT risk register to every department head on a fixed monthly schedule
Why A is correct: When appetite, tolerance and priorities flow from the approved strategic objectives, the risk approach is demonstrably governed by strategy rather than run as an isolated technical exercise.
Why B is wrong: Mapping risks to objectives is useful and tempting because it shows traceability, but it documents exposure rather than proving the overall approach is steered by strategy.
Why C is wrong: Closure rates measure operational efficiency of treatment, so they look like progress, yet they say nothing about whether the work served the organisation's strategic goals.
Why D is wrong: Wide distribution improves transparency and feels like good governance, but circulating a register does not show that risk decisions are anchored to business strategy.