An effective risk management program is a systematic and consistent process of identifying, analyzing, evaluating, treating, monitoring, and communicating risks that may affect the achievement of the organization’s objectives12.

The best indication of an effective risk management program is that the residual risk, which is the risk remaining after risk treatment, is within the organizational risk appetite, which is the amount and type of risk that the organization is willing to accept in pursuit of its objectives12.

This indicates that the organization has successfully implemented appropriate risk responses that align with its risk strategy and criteria, and that the organization is able to balance the potential benefits and costs of taking risks12.

The other options are not the best indication, but rather components or outcomes of an effective risk management program. For example:

Risk action plans are approved by senior management is an outcome of an effective risk management program that demonstrates the commitment and accountability of the leadership for risk management12.

Mitigating controls are designed and implemented is a component of an effective risk management program that involves reducing the likelihood or impact of a risk event12.

Risk is recorded and tracked in the risk register is a component of an effective risk management program that involves documenting and updating the risk information and status12. References =

1: Risk IT Framework, ISACA, 2009

2: IT Risk Management Framework, University of Toronto, 2017