Which term refers to the coordinated activities to direct and control an enterprise with regard to risk?

Which term refers to the coordinated activities to direct and control an enterprise with regard to risk?

• A. Risk governance
• B. Asset
• C. Stakeholder
• D. Access risk

Answer: (A)

The concept being tested is risk governance—the coordinated activities that establish how an organization directs and controls its approach to risk. Risk governance provides the framework, accountability, and oversight—the policies, risk appetite, roles, and decision-making processes—that guide how risk is identified, assessed, managed, and monitored across the enterprise. It sits above day-to-day risk management activities, ensuring those activities align with objectives, regulatory requirements, and stakeholder expectations. An asset is a resource of value the organization uses or holds, not a governance framework. A stakeholder is anyone with an interest in the organization, which is about who is affected or involved, not the control structure for risk. Access risk refers to a type of risk related to unauthorized or inappropriate access, not to the overarching governance mechanism that directs risk across the enterprise.

The concept being tested is risk governance—the coordinated activities that establish how an organization directs and controls its approach to risk. Risk governance provides the framework, accountability, and oversight—the policies, risk appetite, roles, and decision-making processes—that guide how risk is identified, assessed, managed, and monitored across the enterprise. It sits above day-to-day risk management activities, ensuring those activities align with objectives, regulatory requirements, and stakeholder expectations.

An asset is a resource of value the organization uses or holds, not a governance framework. A stakeholder is anyone with an interest in the organization, which is about who is affected or involved, not the control structure for risk. Access risk refers to a type of risk related to unauthorized or inappropriate access, not to the overarching governance mechanism that directs risk across the enterprise.