CISM Information Security Risk Management Practice Question
Which of the following is the primary purpose of communicating risk assessment results to senior management?
⚠ Common exam trap
Test-takers frequently confuse the operational goal of 'justifying the budget' (Option D) with the strategic governance purpose of 'enabling risk acceptance decisions,' but CISM emphasizes that risk communication to senior management is fundamentally about obtaining informed risk acceptance, not securing funding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To enable informed decision-making about risk acceptance
The primary purpose of communicating risk assessment results to senior management is to provide the necessary information for informed decision-making regarding risk acceptance, transfer, or mitigation. Senior management holds the authority to accept residual risk based on a clear understanding of the potential impact and likelihood, which is a core tenet of the CISM framework for information security risk management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To comply with regulatory requirements
Why it's wrong here
Compliance is a driver but the purpose is decision-making.
- ✓
To enable informed decision-making about risk acceptance
Why this is correct
Senior management needs information to make decisions.
- ✗
To assign blame for security failures
Why it's wrong here
Assigning blame is counterproductive.
- ✗
To justify the security budget
Why it's wrong here
Budget justification may result but is not the primary purpose.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.