The Best Outcome Measure for IT Risk Management Processes

A.

The BEST outcome measure to determine the effectiveness of IT risk management processes is option D: Number of events impacting business processes due to delays in responding to risks.

Explanation:

Option A: Time lag between when IT risk is identified and the enterprise's response: This measure indicates the speed of response to IT risks but does not necessarily indicate the effectiveness of the response. It is possible to respond quickly to IT risks, but the response may not be effective in managing the risks.

Option B: Percentage of business users satisfied with the quality of risk training: While this measure can be an indicator of the effectiveness of risk training, it does not necessarily measure the effectiveness of IT risk management processes. It only indicates whether the business users are satisfied with the quality of the training provided.

Option C: Frequency of updates to the IT risk register: This measure indicates the frequency of updates to the IT risk register, but it does not necessarily measure the effectiveness of IT risk management processes. It is possible to update the IT risk register frequently, but the risks may not be managed effectively.

Option D: Number of events impacting business processes due to delays in responding to risks: This measure indicates the impact of IT risks on business processes and the effectiveness of the response to IT risks. A low number of events indicates effective risk management, while a high number of events indicates ineffective risk management.

Therefore, option D is the BEST outcome measure to determine the effectiveness of IT risk management processes.