Risk Appetite Influence on Regulatory Response

Risk Governance
Answer Correct answer: D — The organization's risk appetite dictates the acceptance or mitigation of regulatory compliance risks.

Which of the following should have the MOST influence on an organization's response to a new industry regulation?

  1. The organization's risk control baselines
  2. The organization's control objectives
  3. The organization's risk management framework
  4. The organization's risk appetite Correct Answer
cism risk appetite regulatory compliance response risk management framework vs appetite information security governance

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests the distinction between the structural process (framework) and the strategic decision driver (appetite) in risk management.

When responding to new industry regulations, an organization's approach is primarily dictated by its risk appetite, which determines the acceptable level of compliance risk versus the cost of mitigation.

Selecting the Risk Management Framework (C) is a frequent error because it provides the overall structure, but the appetite specifically dictates the decision outcome.

Community Discussion (3 comments)

Josef4CISM 👍 1 Selected: D
Its D - the organization may decide whether to accept the risk of non-compliance, if risk tolerance is wide.
Evedzy 👍 2
C , Risk appetite is part of the broader framework , The risk management framework provides the most comprehensive foundation for responding to a new industry regulation.
arafatms2000 👍 2
C. The organization's risk management framework

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Risk appetite defines the amount and type of risk an organization is willing to accept. When a new regulation emerges, the organization must decide whether to comply, mitigate, transfer, or accept the risk of non-compliance. This decision is fundamentally driven by the organization's risk appetite; if the potential penalties fall within the acceptable tolerance, the response may differ than if the appetite is low.

Why the Other Options Are Wrong

Control baselines (A) and control objectives (B) are tactical standards or goals used to implement security, not the strategic driver for high-level response decisions. The Risk Management Framework (C) provides the process and structure for managing risk, but it is the risk appetite that provides the specific direction and boundaries for the response within that framework.

Community Comment Notes

While some community comments argued for the Risk Management Framework (C) as the comprehensive foundation, the voting consensus (100%) strongly favored Risk Appetite (D). Commenters supporting D noted that an organization may decide to accept the risk of non-compliance if their tolerance is wide, highlighting appetite as the decisive factor.

Official Reference

Exam Strategy

Focus on the specific outcome requested. If the question asks about the process of managing risk, look for Framework. If it asks about the decision or level of response, look for Risk Appetite.

Related Analysis

A business impact analysis (BIA) BEST enables an organizatio

A-Grade

Who should decide whether a specific control should be chang

A-Grade

When an organization implements an information security gove

A-Grade

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide