ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Business objectives relate to the organization's mission and the concrete goals it must achieve, such as meeting a legislated service-delivery deadline or revenue target. Deciding to accept risk should therefore focus on whether the residual risk endangers those objectives. A delay that prevents the portal from launching on the statutory date directly threatens delivery of benefits, so this impact must drive the acceptance decision. The security officer's personal preferences, potential media coverage, or the presence of a control in a catalog are important context, but they do not in themselves describe the organization's mission or strategic business goals and therefore are not the primary business-objective consideration.