Changes in which of the following are MOST likely to trigger the need to reassess...

Inherent risk reflects exposure before controls. Whenregulatory requirementschange, they can alter compliance obligations, legal exposure, and the baseline inherent risk of processes.

ISACA’s CRISC framework specifies:

“Significant changes to regulatory or legal environments are triggers for reassessing inherent and residual risk.”

A(risk tolerance) affects acceptance, not inherent risk itself.

C(KRIs) andD(benchmarks) measure and compare risk but do not trigger reassessment directly.

Hence,Bis correct.

CRISC Reference:Domain 2 – IT Risk Assessment, Topic: Risk Triggers and Environmental Changes.