Best metric to gain senior management support for risk treatment?

CISM By islever Editorial Last updated

Short answer

C Communicate quantitative loss to align risk with financial impact.

Question

Communicating which of the following would be MOST helpful to gain senior management support for risk treatment options?
  1. Threat analysis
  2. Root cause analysis
  3. Quantitative loss Correct Answer
  4. Industry benchmarks

Key Takeaways

This question tests the translation of technical risks into business language, specifically financial impact, avoiding the trap of presenting technical details like threat analysis.

Quantitative loss analysis is the most effective method to communicate risk to senior management because it translates technical uncertainties into financial terms. The community consensus confirms that executives prioritize data expressed in monetary value for resource allocation.

Common mistake: Selecting Industry benchmarks is a common error because while it offers context, it fails to provide the specific financial impact necessary to justify internal budget allocation.

Expert Analysis

Why the Answer Is Correct

Quantitative loss analysis expresses risk in monetary terms, which is the primary language of business executives. As noted in community comments, this provides a clear financial perspective that enables decision-makers to prioritize resources effectively. It directly aligns risk mitigation costs with potential financial exposure, making the business case for treatment options undeniable.

Why the Other Options Are Wrong

Threat analysis is often qualitative and technical, focusing on vectors rather than business impact, which does not resonate with senior management. Root cause analysis is reactive and typically used post-incident to understand failures rather than to justify proactive investments. Industry benchmarks offer comparative context but lack the specific financial urgency required to secure funding for internal risk treatments.

Community Comment Notes

Comments consistently highlight that senior management cares about financial impact and strategic disruption. One user emphasized that quantitative loss allows communication in terms that matter most to executives, such as business continuity. Another comment reinforced that this approach speaks the business language necessary to gain support.

Official Reference

https://www.isaca.org/credentialing/cism

This link opens the official vendor documentation in a new tab.

Exam Strategy

When questions involve senior management or board support, always prioritize answers that express risk in financial terms or business impact. Executives speak the language of money, so quantitative data trumps qualitative technical details.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Booict 👍 3
    C - Quantitative Loss: Provides a clear financial perspective on potential losses due to risks. Enables decision-makers to prioritize and allocate resources effectively. Aligns with business objectives and speaks their language.
  2. SHERLOCKAWS 👍 1 Answered C
    Answer is C: Quantitative loss. Because it allows you to communicate risk in terms that matter most to senior management such as financial impact, strategic disruption, and business continuity.
  3. ServerBrain 👍 1 Answered C
    C. Quantitative loss

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Best Defense Against DDoS Attacks in Enterprise Networks?

S-grade

When Should a Business Continuity Plan Be Primarily Triggered?

S-grade

Which Approach Best Communicates Security to Senior Management?

S-grade

How to Keep a Business Continuity Plan Current?

S-grade

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide