During an audit, an IS auditor notices that the IT department of a medium-sized organization has
no separate risk management function, and the organization’s operational risk documentation only
contains a few broadly described IT risks. What is the MOST appropriate recommendation in this
situation?

A.
Create an IT risk management department and establish an IT risk framework with the aid of external
risk management experts.

B.
Use common industry standard aids to divide the existing risk documentation into several individual
risks which will be easier to handle.

C.
No recommendation is necessary since the current approach is appropriate for a medium-sized
organization.

D.
Establish regular IT risk management meetings to identify and assess risks, and create a mitigation
plan as input to the organization’s risk management.

Explanation:
Establishing regular meetings is the best way to identify and assess risks in a medium- sized
organization, to address responsibilities to the respective management and to keep the risk list and
mitigation plans up to date. A medium-sized organizationwould normally not have a separate IT
risk management department. Moreover, the risks are usually manageable enough so that external
help would not be needed. While common risks may be covered by common industry standards,
they cannot address the specific situation of an organization. Individual risks will not be discovered
without a detailed assessment from within the organization. Splitting the one risk position into
several is not sufficient.