You are the project manager of GHT project. You have selected appropriate Key Risk Indicators
for your project. Now, you need to maintain those Key Risk Indicators. What is the MOST
important reason to maintain Key Risk Indicators?

A.
Risk reports need to be timely

B.
Complex metrics require fine-tuning

C.
Threats and vulnerabilities change over time

D.
They help to avoid risk

Explanation:

Since the enterprise’s internal and external environments are constantly changing, the risk
environment is also highly dynamic, i.e., threats and vulnerabilities change over time. Hence KRIs

need to be maintained to ensure that KRIs continue to effectively capture these changes.
Answer A is incorrect. Timely risk reporting is one of the business requirements, but is not the
reason behind KRI maintenance.
Answer B is incorrect. While most key risk indicator metrics need to be optimized in respect to
their sensitivity, the most important objective of KRI maintenance is to ensure that KRIs continue
to effectively capture the changes in threats and vulnerabilities over time.
Answer D is incorrect. Avoiding risk is a type of risk response. Risk responses are based on KRI
reporting.