CISSP Domain 4 – Risk and Control Monitoring and Reporting Practice Test

Determining risk limits is a critical component of the risk management process and it typically occurs during the risk assessment phase. In this phase, organizations identify and evaluate the risks they face and establish acceptable levels of risk exposure. This involves setting thresholds for various types of risk, which helps in deciding what risks are acceptable and what measures need to be taken to mitigate those that exceed defined limits. By establishing these limits, organizations can prioritize their risk response strategies effectively, ensuring better risk management and alignment with business objectives.

While other phases of risk management, such as risk mitigation, risk monitoring, and risk response, focus on addressing, tracking, and managing identified risks, they do not primarily involve the determination of risk limits. The risk mitigation phase is where strategies are implemented to reduce risk, the risk monitoring phase involves tracking identified risks and assessing the effectiveness of mitigation strategies, and the risk response phase focuses on the actions taken once risks have been assessed and limits defined. Therefore, the correct phase for determining risk limits is indeed the risk assessment phase.