Certified in Risk and Information Systems Control (CRISC) — Question 872

Which of the following is the MOST critical factor to consider when determining an organization's risk appetite?

Answer options

• A. Budget for implementing security
• B. Business maturity
• C. Fiscal management practices
• D. Management culture

Correct answer: D

Explanation

Management culture is crucial because it shapes how risks are perceived and addressed within an organization. While budget, business maturity, and fiscal practices are important, they are often influenced by the underlying management culture, which ultimately drives decision-making and risk tolerance.