An employee has worked on the organizational risk assessment. The goal of the assessment is not to bring residual risks to zero, but to bring the residual risks in line with an organization’s risk appetite.
When has the risk assessment program accomplished its primary goal?
A. Once the controls are implemented
B. Once the transference of the risk is complete
C. When decision makers have been informed of uncontrolled risks and proper authority groups decide to leave the risks in place
D. When the risk analysis is completed