- Should organizations not engage in any activity which may have associated risks? (meaning why take any risk at all?)

-Can Risks be eliminated?

- Why should Risk Management be a life-cycle or a continuous effort?

-Does introduction of IT into business reduce or increase risks?

-It has been said that risks should be reduced to an "acceptable level" which implies that there is still some left-over risk. Why would we want to have any left-over risk?Do you agree with the concept of "acceptable level" of risk?

-how do you mitigate risks?

-Whose responsibilities is to oversee IT Risk Management?

-Who provides assurance that IT risks are being managed effectively?

-Are threats relevant if you are not vulnerable to them ?