Many organizations use metrics to evaluate their risk management program. The selection of these tools is influenced by factors such as management priorities, regulatory concerns, and risk appetite. Which one of the following measurement systems would you recommend and why? Balanced Scorecard, CMMI, Six Sigma, or another? Do you see a possible conflict between these measurement systems and one or more of the commonly used risk frameworks/standards such as COSO, the ISO 31XXX series, COBIT, the NIST Cyber Framework, the ISO 223XX series, or TOGAF?

  Do not analyze all the tools listed. They are cited for illustration purposes only.