CRISC Information Technology and Security Practice Question
An organization is implementing COBIT 2019 and the board has requested assurance that risk management activities are aligned with business objectives. Which governance objective is primarily focused on ensuring risk optimization through evaluation, direction, and monitoring?
⚠ Common exam trap
CRISC often tests the distinction between EDM03 (governance-level risk optimization) and APO12 (management-level risk execution), and candidates frequently pick EDM01 because it sounds like the overarching governance objective rather than the risk-specific one.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EDM03 — Ensure Risk Optimization
COBIT 2019's EDM03 — Ensure Risk Optimization is the governance objective that ensures enterprise risk management activities are aligned with business objectives by evaluating, directing, and monitoring risk appetite, tolerance, and capacity. It is the EDM domain objective specifically focused on risk optimization, making it the correct answer for the board's assurance need described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
EDM01 — Ensure Governance Framework Setting and Maintenance
Why it's wrong here
EDM01 addresses the overarching governance framework, not the specific evaluation, direction, and monitoring of risk optimisation. The board’s request targets risk alignment with business objectives, which is the domain of EDM03 (Ensure Risk Optimisation). EDM01 would be correct if the scenario asked for establishing the governance structure itself, such as defining principles or assigning accountabilities, rather than directly managing risk outcomes.
- ✗
EDM02 — Ensure Benefits Delivery
Why it's wrong here
EDM02 governs benefit realisation from investments, not risk optimisation, so it cannot satisfy the board's assurance request. It is tempting because benefits delivery does involve evaluating and directing portfolios, and it would be correct where the board sought assurance that IT investments deliver expected value rather than that risk is optimised.
- ✓
EDM03 — Ensure Risk Optimization
Why this is correct
EDM03 — Ensure Risk Optimization is the governance objective covering evaluation, direction and monitoring of risk management, ensuring it aligns with business objectives. It sits within the Evaluate, Direct and Monitor domain, matching the board's assurance request.
- ✗
EDM04 — Ensure Resource Optimization
Why it's wrong here
EDM04 addresses optimal sourcing and use of IT resources — cost, capability and capacity — not risk. It is the correct objective when the board seeks assurance that IT investments and resource allocation deliver value efficiently.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.