Which term encompasses the overall risk environment, defines the areas risk management activities will address and provides a structure for I&T-related risk management?

Which term encompasses the overall risk environment, defines the areas risk management activities will address and provides a structure for I&T-related risk management?

• A. Risk universe
• B. Risk governance
• C. Asset
• D. Stakeholder

Answer: (A)

The concept being tested is how the scope and organizing framework for IT risk management are defined. The term that best fits is the risk universe, because it describes the entire risk environment an organization faces and sets the boundaries and categories that risk management activities will address. It provides the structure for organizing, prioritizing, and tracking risks across IT, operations, security, third parties, and other domains, ensuring a coherent approach to identifying, assessing, and treating risk in line with the organization’s risk appetite. In contrast, risk governance focuses on who has authority and accountability for risk decisions, not the overall scope; an asset is a thing of value to protect; a stakeholder is someone with an interest in risk outcomes.

The concept being tested is how the scope and organizing framework for IT risk management are defined. The term that best fits is the risk universe, because it describes the entire risk environment an organization faces and sets the boundaries and categories that risk management activities will address. It provides the structure for organizing, prioritizing, and tracking risks across IT, operations, security, third parties, and other domains, ensuring a coherent approach to identifying, assessing, and treating risk in line with the organization’s risk appetite. In contrast, risk governance focuses on who has authority and accountability for risk decisions, not the overall scope; an asset is a thing of value to protect; a stakeholder is someone with an interest in risk outcomes.