Which outcome describes developing and implementing an organization-wide strategy for monitoring control effectiveness?

• A. An organization-wide strategy for monitoring control effectiveness is developed and implemented.
• B. The authorization boundary is determined.
• C. The stakeholders having an interest in the system are identified.
• D. The assets are identified and prioritized.

Answer: (A)

In risk management, developing and implementing an organization-wide strategy for monitoring control effectiveness means creating a formal plan for how security controls will be tested, observed, and reported across the organization, ensuring ongoing assurance of their performance. This outcome captures the ongoing, holistic approach to monitor controls rather than just defining scope or identifying people or assets. The other options describe setup activities—defining system boundaries, recognizing stakeholders, and identifying assets—which are important but do not specify establishing a continuous, organization-wide monitoring program.