Which statement best describes the relationship between IT risk management and business goals?

• A. IT risk management operates independently of business goals.
• B. IT risk management ensures IT supports business goals and manages risk.
• C. IT risk management only addresses cyber threats and ignores other risks.
• D. IT risk management is optional for governance.

Answer: (B)

IT risk management should align with and support business goals, ensuring IT enables value while mitigating threats to those goals. When business objectives are in view, IT risk management identifies and prioritizes risks that could derail those objectives, and it designs controls and resilience measures that protect critical processes, data, and services. This integrated approach helps leadership decide where to invest, how to balance risk and opportunity, and how to maintain continuity as goals evolve.

This broader view explains why the statement fits best: IT risk management isn’t about IT in isolation or only about cybersecurity. It’s about making sure IT activities actively support what the business is trying to achieve while keeping risks within acceptable levels. It’s also not optional; governance relies on aligning IT risk management with strategic aims to protect and enable the organization.

For context, consider a goal to roll out a new digital service. Effective IT risk management would anticipate risks to availability, security, and compliance, and implement measures to keep the service reliable and trustworthy, aligning technical decisions with business priorities and risk appetite.