Risk Appetite Influence on Regulatory Response

CISM By islever Editorial Last updated

Short answer

D The organization's risk appetite dictates the acceptance or mitigation of regulatory compliance risks.

Question

Which of the following should have the MOST influence on an organization's response to a new industry regulation?
  1. The organization's risk control baselines
  2. The organization's control objectives
  3. The organization's risk management framework
  4. The organization's risk appetite Correct Answer

Key Takeaways

This question tests the distinction between the structural process (framework) and the strategic decision driver (appetite) in risk management.

When responding to new industry regulations, an organization's approach is primarily dictated by its risk appetite, which determines the acceptable level of compliance risk versus the cost of mitigation.

Common mistake: Selecting the Risk Management Framework (C) is a frequent error because it provides the overall structure, but the appetite specifically dictates the decision outcome.

Expert Analysis

Why the Answer Is Correct

Risk appetite defines the amount and type of risk an organization is willing to accept. When a new regulation emerges, the organization must decide whether to comply, mitigate, transfer, or accept the risk of non-compliance. This decision is fundamentally driven by the organization's risk appetite; if the potential penalties fall within the acceptable tolerance, the response may differ than if the appetite is low.

Why the Other Options Are Wrong

Control baselines (A) and control objectives (B) are tactical standards or goals used to implement security, not the strategic driver for high-level response decisions. The Risk Management Framework (C) provides the process and structure for managing risk, but it is the risk appetite that provides the specific direction and boundaries for the response within that framework.

Community Comment Notes

While some community comments argued for the Risk Management Framework (C) as the comprehensive foundation, the voting consensus (100%) strongly favored Risk Appetite (D). Commenters supporting D noted that an organization may decide to accept the risk of non-compliance if their tolerance is wide, highlighting appetite as the decisive factor.

Official Reference

https://www.isaca.org/resources/cobit

This link opens the official vendor documentation in a new tab.

Exam Strategy

Focus on the specific outcome requested. If the question asks about the process of managing risk, look for Framework. If it asks about the decision or level of response, look for Risk Appetite.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Evedzy 👍 2
    C , Risk appetite is part of the broader framework , The risk management framework provides the most comprehensive foundation for responding to a new industry regulation.
  2. arafatms2000 👍 2
    C. The organization's risk management framework
  3. Josef4CISM 👍 1 Answered D
    Its D - the organization may decide whether to accept the risk of non-compliance, if risk tolerance is wide.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Best Defense Against DDoS Attacks in Enterprise Networks?

S-grade

When Should a Business Continuity Plan Be Primarily Triggered?

S-grade

Which Approach Best Communicates Security to Senior Management?

S-grade

How to Keep a Business Continuity Plan Current?

S-grade

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide