For which of the following risk management capability maturity levels do the statement given
below is true? “Real-time monitoring of risk events and control exceptions exists, as does
automation of policy management”

A.
Level 3

B.
Level 0

C.
Level 5

D.
Level 2

Explanation:

An enterprise’s risk management capability maturity level is 5 when real-time monitoring of risk
events and control exceptions exists, as does automation of policy management.
Answer B is incorrect. In level 0 of risk management capability maturity model, enterprise does

not recognize the importance of considering the risk management or the business impact from IT
risk.