While defining the risk management strategies, what are the major parts to be determined first?
Each correct answer represents a part of the solution. Choose two.

A.
IT architecture complexity

B.
Organizational objectives

C.
Risk tolerance

D.
Risk assessment criteria

Explanation:

While defining the risk management strategies, risk professional should first identify and analyze
the objectives of the organization and the risk tolerance. Once the objectives of enterprise are
known, risk professional can detect the possible risks which can occur in accomplishing those
objectives. Analyzing the risk tolerance would help in identifying the priorities of risk which is the
latter steps in risk management. Hence these two do the basic framework in risk management.
Answer A is incorrect. IT architecture complexity is related to the risk assessment and not the risk
management, as it does much help in evaluating each significant risk identified.
Answer D is incorrect. Risk assessment is one of the various phases that occur while managing
risks, which uses quantitative and qualitative approach to evaluate risks. Hence
riskassessmentcriteria is only a part of this framework.