Câu 536: Isaca Certified in Risk and Information Systems Control

Which of the following is NOT true for risk management capability maturity level 1?

1. A. There is an understanding that risk is important and needs to be managed, but it is viewed as a technical issue and the business primarily considers the downside of IT risk
2. B. Decisions involving risk lack credible information
3. C. Risk appetite and tolerance are applied only during episodic risk assessments — đáp án hiện tại
4. D. Risk management skills exist on an ad hoc basis, but are not actively developed