In the risk data model, which of the following could represent a risk statement?

In the risk data model, which of the following could represent a risk statement?

• A. Risk Statement
• B. Policy Statement
• C. Control Objective
• D. Authority Document

Answer: (A)

In the risk data model, a risk statement is the formal description of a specific risk scenario. It captures what could happen, which asset is affected, the threat and vulnerability involved, and the potential impact and likelihood. This statement serves as the anchor for risk assessments and is the element that other artifacts—such as controls and governance documents—refer back to. A policy statement expresses rules and guidance rather than a specific risk event. A control objective describes what a control is intended to achieve, not the risk itself. An authority document is a governance or authorization artifact, not a description of a risk. Therefore, the risk statement best represents a risk within the data model.

In the risk data model, a risk statement is the formal description of a specific risk scenario. It captures what could happen, which asset is affected, the threat and vulnerability involved, and the potential impact and likelihood. This statement serves as the anchor for risk assessments and is the element that other artifacts—such as controls and governance documents—refer back to.

A policy statement expresses rules and guidance rather than a specific risk event. A control objective describes what a control is intended to achieve, not the risk itself. An authority document is a governance or authorization artifact, not a description of a risk. Therefore, the risk statement best represents a risk within the data model.