Which of the following factors are commonly assessed to determine the magnitude of risk events?

To determine the magnitude of risk events, organizations commonly assess both the potential impact of the risk event and its likelihood of occurrence. Impact refers to the extent of the consequences if the risk were to materialize, while likelihood refers to the probability of the risk event occurring. Together, these factors help in quantifying and prioritizing risks, enabling more effective risk management decisions.

Tolerance and appetite (A) are related to the organization ' s willingness to accept certain levels of risk, not directly to assessing the magnitude of specific risk events. Inherent and residual risk (B) describe risk levels before and after controls are applied, respectively. Cost and benefit (C) pertain to evaluating the financial implications and potential returns of risk management strategies.

COSO Enterprise Risk Management Framework

IIA Global Technology Audit Guide (GTAG) " Management of IT Auditing "