Question 221 · 1449 in bank
Which of the following provides the MOST useful information for regular reporting to senior management on the control environment's effectiveness?
Show answer
Answer: B
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following provides the MOST useful information for regular reporting to senior management on the control environment's effectiveness?
Answer: B
The IT risk profile is PRIMARILY a communication tool for:
Answer: B
Which of the following BEST promotes alignment between IT risk management and enterprise risk management?
Answer: C
Which of the following BEST describes the utility of a risk?
Answer: B
A risk can be defined as an uncertain event or condition that, if it occurs, has a positive or negative effect on a project's objectives. The potential opportunity of a risk refers to the potential benefit or advantage that can be gained from taking on a risk, such as cost savings, increased revenue, or new market opportunities. The finance incentive behind the risk, the mechanics of how a risk works, and the usefulness of the risk to individuals or groups are all related but not the utility of a risk. The utility of a risk is the potential benefit or advantage that can be gained from taking on a risk.
Source: Adapted from community discussion — mfourati
Which of the following is MOST important for an IT risk practitioner to update once risk mitigation action plans have been verified as completed?
Answer: A
This is covered in the 7th edition of the review manual, pg 161 3.8.3 and pg 165 3.9.2. Pg 161 talks only about updating documentation related to the control. Pg 165 talks about after the control is deemed effective, update the risk register. If you think the question is making a point of omitting that the control has been evaluated as effective, then "control inventory" is the best answer. If you think it is about remembering to update the risk register then A seems the better answer. Horrible question :)
Source: Adapted from community discussion — CbtL
To obtain support from senior management for an increase in the risk mitigation budget, it is BEST to prioritize risk scenarios in the risk register based on:
Answer: B
Which of the following is the PRIMARY reason to perform periodic vendor risk assessments?
Answer: C
Using key risk indicators (KRIs) to illustrate changes in the risk profile PRIMARILY helps to:
Answer: C
An organization's chief information officer (CIO) has proposed investing in a new, untested technology to take advantage of being first to market. Senior management has concerns about the success of the project and has set a limit for expenditures before final approval. This conditional approval indicates the organization's risk:
Answer: D
A hospital's Internet of Things (IoT) bio-medical devices were recently hacked. Which of the following methods would BEST assist in identifying the control deficiencies?
Answer: D
Not correct, this same question appears in the self-assessment questions of the 7th CRISC manual (chapter 2): Controls are deployed to achieve desired control objectives based on risk assessments and business requirements. The gap between the desired control objectives and the effectiveness of the control design identifies deficiencies.
Source: Adapted from community discussion — john_boogieman
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 221. 1449 questions available.
Version 1.0.0. How we source questions