Question 211 · 1449 in bank
Which of the following provides the MOST useful information when assessing whether an organization has appropriately managed its level of risk compared to its established risk appetite?
Show answer
Answer: B
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following provides the MOST useful information when assessing whether an organization has appropriately managed its level of risk compared to its established risk appetite?
Answer: B
Which of the following is the MOST important reason for a risk practitioner to identify stakeholders for each IT risk scenario?
Answer: C
Identifying stakeholders for each IT risk scenario is the most important reason for a risk practitioner to ensure enterprise-wide risk management. Stakeholders are individuals or groups who have a vested interest in the outcome of a risk scenario and can be impacted by it. By identifying stakeholders for each IT risk scenario, a risk practitioner can ensure that all relevant parties are aware of the risk and are able to contribute to the management of that risk. This enables enterprise-wide risk management, as it ensures that all stakeholders are aware of and engaged in the risk management process. Other reasons, such as identifying key risk indicators (KRIs), enabling a comprehensive view of risk, and establishing control ownership, may also be important considerations, but ensuring enterprise-wide risk management is the most important reason for identifying stakeholders for each IT risk scenario.
Source: Adapted from community discussion — GRamos
Which of the following control detects problem before it can occur?
Answer: D
Preventative controls are the controls that detect the problem before it occurs. They attempt to predict potential problems and make adjustments to prevent those problems to occur in near future. This prediction is being made by monitoring both the system's operations and its inputs. Incorrect Answers: A: Deterrent controls are similar to the preventative controls, but they diminish or reverse the attraction of the environment to prevent risk from occurring instead of making adjustments to the environment. B: Detective controls simply detect and report on the occurrence of a problems. They identify specific symptoms to potential problems. C: Compensation controls ensure that normal business operations continue by applying appropriate resource.
Source: Adapted from community discussion — Stanislav_crisc
What is the PRIMARY role of the application owner when changes are being introduced into an existing environment?
Answer: D
Which of the following is the BEST way to evaluate the risk awareness of control owners?
Answer: A
'A'. Including control owners in risk committee meetings and risk reporting can help to ensure that they are aware of the organization's risk landscape and the role their controls play in mitigating risks. However, to evaluate the risk awareness of control owners, conducting surveys and trend analysis of the results over time can be more effective. This approach can help to identify knowledge gaps and areas where additional training or communication may be needed to improve risk awareness and control effectiveness.
Source: Adapted from community discussion — john_boogieman
Which of the following is the MOST effective key risk indicator (KRI) for monitoring problem management?
Answer: C
From a risk management perspective, which of the following is the PRIMARY purpose of conducting a root cause analysis following an incident?
Answer: C
Which of the following is MOST critical for a risk practitioner to continuously monitor to support senior management's risk-related decision making?
Answer: C
Risk avoidance is the BEST risk treatment strategy when:
Answer: D
Which of the following is the MOST important objective from a cost perspective for considering aggregated risk responses in an organization?
Answer: B
Address more than one risk response. Aggregating risk responses enables an organization to tackle multiple risks simultaneously, reducing the total cost of risk management. By addressing multiple risks with a single response, the organization can realize economies of scale and reduce the overall cost of managing risks. Prioritizing risk response options is also important, but it is not the primary objective when considering aggregated risk responses from a cost perspective.
Source: Adapted from community discussion — john_boogieman
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 211. 1449 questions available.
Version 1.0.0. How we source questions