Periodic review of all other components should be based on what?

• A. Annual risk assessment only
• B. Organization's policies and risk management strategy as determined by annual risk assessment
• C. Ad hoc decisions
• D. Vendor recommendations

Answer: (B)

Periodic reviews should be guided by the organization’s policies and risk management strategy, as defined by the annual risk assessment. This approach ensures that every review aligns with approved risk priorities and tolerance, so resources focus on what matters most and the process remains consistent and auditable. The annual risk assessment identifies where risk is highest and what controls are most appropriate, and the policy-driven framework translates that into how and when components are reviewed. Relying on the risk assessment alone without a governance framework can lead to drift, and making decisions ad hoc or solely following vendor recommendations lacks the structured basis needed for comprehensive, stable risk management.