What does 'risk optimization' entail in IT governance?

• A. Eliminating all risk from IT initiatives.
• B. Maximizing risk to maximize potential gains.
• C. Ignoring risk in favor of speed.
• D. Balancing risk and control to optimize risk exposure in pursuit of objectives, not avoiding risk entirely.

Answer: (D)

Risk optimization in IT governance means choosing and tuning controls so that risk exposure stays within levels that support the organization’s objectives. It acknowledges that not all risk can be or should be removed; instead, the goal is to reduce risk to an acceptable level where the costs and effort of protection are justified by the value they safeguard. In practice, this involves understanding the organization’s risk appetite, assessing threats and vulnerabilities, and applying safeguards that are proportionate to the risk. The residual risk after protections should align with strategic goals, and the approach is dynamic—monitoring and adjusting controls as technology and priorities evolve to avoid overspending on risk reduction or neglecting risks that matter.