CRISC practice questions 1,171–1,180

1. Question 1171 · 1449 in bank

   Select 3

   What are the responsibilities of the CRO? Each correct answer represents a complete solution. (Choose three.)

   • AManaging the risk assessment process
   • BImplement corrective actions
   • CAdvising Board of Directors
   • DManaging the supporting risk management function

   Show answer

   Answer: ACD

   Explanation

   There is no way the CRO will be responsible for implementing corrective action. That is a first line role- operation management- and the CRO falls in second line. The CRO can well advice executive management and the board on Risk issues that they need to know about. Correct answer should be ACD

   Source: Adapted from community discussion — Hashi1_snr

   Next question

2. Question 1172 · 1449 in bank

   Which of the following would BEST help identify the owner for each risk scenario in a risk register?

   • AAllocating responsibility for risk factors equally to asset owners.
   • BDetermining resource dependency of assets.
   • CMapping identified risk factors to specific business processes.
   • DDetermining which departments contribute most to risk.

   Show answer

   Answer: C

   Next question

3. Question 1173 · 1449 in bank

   To effectively support business decisions, an IT risk register MUST:

   • Areflect the results of risk assessments.
   • Beffectively support a business maturity model.
   • Cbe available to operational risk groups.
   • Dbe reviewed by the IT steering committee.

   Show answer

   Answer: A

   Explanation

   Process of maintaining a risk register begins from risk identification stage itself. Results of risk identification are the initial entries into the risk register. A?

   Source: Adapted from community discussion — GLin

   Next question

4. Question 1174 · 1449 in bank

   Which of the following is the STRONGEST indication that controls implemented as part of a risk action plan are not effective?

   • AA security breach occurs.
   • BInternal audit identifies recurring exceptions.
   • CChanges are put into production without management approval.
   • DA sample is used to validate the action plan.

   Show answer

   Answer: B

   Explanation

   B. Internal audit identifies recurring exceptions. While all the options indicate potential issues with control effectiveness or process discipline, the strongest indication that controls are not effective is when recurring exceptions are identified by an internal audit. This shows that not only did an issue occur, but it continues to happen repeatedly, suggesting that the controls in place are either not working or not being adhered to.

   Source: Adapted from community discussion — 01010100

   Next question

5. Question 1175 · 1449 in bank

   Which of the following issues regarding an organization's IT incident response plan would be the GREATEST concern?

   • AThe incident response capability is outsourced.
   • BTeams are not operational until an incident occurs.
   • CNot all employees have attended incident response training.
   • DRoles and responsibilities are not clearly defined.

   Show answer

   Answer: D

   Next question

6. Question 1176 · 1449 in bank

   Prudent business practice requires that risk appetite not exceed:

   • Arisk capacity.
   • Binherent risk.
   • Crisk tolerance.
   • Dresidual risk.

   Show answer

   Answer: A

   Explanation

   Because exceeding the capacity, means that the organization will go under. Appetite and tolerance are different. Tolerance is appetite + a little extra. From the book: Risk tolerance is defined as the acceptable level of variation that management is willing to allow for any particular risk as the enterprise pursues its objectives. The interpretation of the ISACA definition is that while management has an official acceptance level of one value, they may accept a slight deviation from that level. An example of tolerance is a situation where the speed limit on a highway is 65 miles/hour, but a police officer may allow a person to travel up to 70 miles/hour before issuing a ticket.

   Source: Adapted from community discussion — fvanderschmudt

   Next question

7. Question 1177 · 1449 in bank

   Which of the following BEST illustrates the relationship of actual risk exposure to appetite?

   • AResidual risk that exceeds appetite.
   • BRisk events in the risk profile.
   • CPercentage of high risk scenarios.
   • DControls that exceed risk appetite.

   Show answer

   Answer: A

   Explanation

   The relationship between actual risk exposure and risk appetite is best illustrated by "Residual risk that exceeds appetite." Residual risk is the risk that remains after risk mitigation measures (controls) have been implemented. If the residual risk exceeds the organization's risk appetite (the level of risk it is willing to accept), it means that the organization is exposed to more risk than it finds acceptable. Option A describes a situation where the remaining risk (residual risk) is beyond what the organization is willing to tolerate (exceeds appetite), making it the best illustration of the relationship between actual risk exposure and risk appetite. It highlights a potential misalignment between the implemented controls and the organization's risk tolerance.

   Source: Adapted from community discussion — SuperMax

   Next question

8. Question 1178 · 1449 in bank

   Which of the following is MOST important to include when identifying risk scenarios for inclusion in a risk review of a third-party service provider?

   • AOpen vendor issues.
   • BPurchasing agreements.
   • CSupplier questionnaires.
   • DProcess mapping.

   Show answer

   Answer: D

   Explanation

   Agree with D. You use the process mapping to help identify risk scenarios, and you then use the risk scenarios to build your questionnaire. With third party risk management, the questionnaire is often the bulk of your risk assessment, and you have to understand the outsourced service(s) / processes to ask the proper questions.

   Source: Adapted from community discussion — CbtL

   Next question

9. Question 1179 · 1449 in bank

   The purpose of requiring source code escrow in a contractual agreement is to:

   • Aensure that the source code is available if the vendor ceases to exist.
   • Bensure the source code is available when bugs occur.
   • Creview the source code for adequacy of controls.
   • Densure that the source code is valid and exists.

   Show answer

   Answer: A

   Next question

10. Question 1180 · 1449 in bank

    Which of the following will BEST help an organization evaluate the control environment of several third-party vendors?

    • AReview vendors' performance metrics on quality and delivery of processes.
    • BReview vendors' internal risk assessments covering key risk and controls.
    • CObtain independent control reports from high-risk vendors.
    • DObtain vendor references from third parties.

    Show answer

    Answer: C

    Explanation

    C. Obtain independent control reports from high-risk vendors. When evaluating the control environment of third-party vendors, independent control reports (such as SOC 2 Type II or ISO 27001 certifications) provide the most comprehensive and reliable insight. These reports are conducted by third-party auditors and assess the effectiveness of a vendor's internal controls over a specific period. Obtaining these independent reports, especially from high-risk vendors, an organization can better evaluate the vendor's control environment without solely relying on the vendor's own assertions or internal documents.

    Source: Adapted from community discussion — 01010100

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1171. 1449 questions available.