 Risk Tolerance and Control Exceptions:

Organizations define their risk tolerance levels based on strategic objectives and resources.

If a risk is within acceptable tolerance, additional controls may not be necessary.

 Why This is Correct:

The decision aligns with the organization’s established risk management framework and priorities.

 Why Other Options Are Incorrect:

A. Improper Audit Process: Unlikely; audits follow structured methodologies.

B. CIO Disagreement: Decisions are based on risk tolerance, not individual opinions.

D. Cyber Insurance: Mitigates financial loss but doesn’t eliminate risk.

 References:

EC-Council emphasizes that risk tolerance guides decisions on implementing controls, ensuring alignment with organizational objectives.