Question

A financial services firm currently performs enterprise risk assessments on a fixed annual cycle. Over the past year, the organization migrated several core services to a cloud provider, acquired a fintech startup, and faced a surge in targeted phishing campaigns. During the most recent annual assessment, several risks were found to have materialized months earlier without detection. What should the risk practitioner recommend to best address this gap?

Accepted Answer

Move to a continuous or event-triggered risk assessment approach driven by significant changes in the environment

Answer

Increase the number of controls tested during the existing annual assessment cycle

Answer

Extend the assessment window to allow more time for gathering comprehensive data each year

Answer

Transfer the newly identified risks to the cyber insurance policy to reduce exposure