The MOST appropriate key performance indicator (KPI) to communicate the effectiveness of an enterprise IT...

The KPI that best measures effectiveness of risk management is one that shows risk alignment with tolerance levels.

CRISC defines:

“Risk management effectiveness is demonstrated when risk scenarios are managed within the organization’s defined tolerance.”

B and C are activity-based, not outcome-based.

D measures realized losses, not ongoing control success.

Hence, A. The percentage of risk scenarios within organizational tolerance directly reflects program effectiveness.

CRISC Reference: Domain 4 – Risk and Control Monitoring and Reporting, Topic: Key Risk and Performance Indicators.