For which of the following risk management capability maturity levels do the statement given
below is true? “Real-time monitoring of risk events and control exceptions exists, as does
automation of policy management”
A.
Level 3
B.
Level 0
C.
Level 5
D.
Level 2
Explanation:
An enterprise’s risk management capability maturity level is 5 when real-time monitoring of risk
events and control exceptions exists, as does automation of policy management.
Answer B is incorrect. In level 0 of risk management capability maturity model, enterprise doesnot recognize the importance of considering the risk management or the business impact from IT
risk.