CRISC practice questions 711–720

1. Question 711 · 1449 in bank

   Which of the following would produce the MOST comprehensive and relevant enterprise risk scenarios?

   • AConduct risk assessment workshops with business process owners.
   • BConduct risk assessment workshops with risk owners.
   • CLeverage current and historical data to inform risk scenarios.
   • DCombine top-down and bottom-up approaches.

   Show answer

   Answer: D

   Next question

2. Question 712 · 1449 in bank

   Which of the following events is MOST likely to trigger an update to the risk register?

   • AA reminder to reassess an identified risk has been sent to risk owners and risk custodians.
   • BA business case for implementing a new solution for automating controls has been proposed.
   • CA project to implement a risk response action plan has been completed and closed successfully.
   • DA post-implementation review of a new application has been initiated by senior management.

   Show answer

   Answer: C

   Next question

3. Question 713 · 1449 in bank

   Select 2

   While developing obscure risk scenarios, what are the requirements of the enterprise? Each correct answer represents a part of the solution. (Choose two.)

   • AHave capability to cure the risk events
   • BHave capability to recognize an observed event as something wrong
   • CHave sufficient number of analyst
   • DBe in a position that it can observe anything going wrong

   Show answer

   Answer: BD

   Explanation

   The enterprise must consider risk that has not yet occurred and should develop scenarios around unlikely, obscure or non-historical events. Such scenarios can be developed by considering two things: ✑ Visibility ✑ Recognition ✑ For the fulfillment of this task enterprise must: ✑ Be in a position that it can observe anything going wrong ✑ Have the capability to recognize an observed event as something wrong Incorrect Answers: A, C: These are not the direct requirements for developing obscure risk scenarios, like curing risk events comes under process of risk management. Hence capability of curing risk event does not lay any impact on the process of development of risk scenarios.

   Next question

4. Question 714 · 1449 in bank

   You are the project manager of GHT project. You have planned the risk response process and now you are about to implement various controls. What you should do before relying on any of the controls?

   • AReview performance data
   • BDiscover risk exposure
   • CConduct pilot testing
   • DArticulate risk

   Show answer

   Answer: C

   Explanation

   C. Conduct pilot testing Pilot testing involves implementing the controls on a smaller scale or in a controlled environment to assess their effectiveness and identify any potential issues or unforeseen consequences. It allows you to test whether the selected controls can effectively mitigate the identified risks before fully implementing them across the entire project. Conducting pilot testing helps ensure that the controls are practical and that they will work as intended in the actual project environment. This step is crucial for risk management as it helps verify that the chosen controls are appropriate and do not introduce new risks or problems.

   Source: Adapted from community discussion — SuperMax

   Next question

5. Question 715 · 1449 in bank

   Which of the following items is considered as an objective of the three dimensional model within the framework described in COSO ERM?

   • ARisk assessment
   • BFinancial reporting
   • CControl environment
   • DMonitoring

   Show answer

   Answer: B

   Explanation

   The COSO ERM (Enterprise Risk Management) frame work is a 3-dimensional model. The dimensions and their components include: ✑ Strategic Objectives - includes strategic, operations, reporting, and compliance. ✑ Risk Components - includes Internal Environment, Objectives settings, Event identification, Risk assessment, Risk response, Control activities, Information and communication, and monitoring. ✑ Organizational Levels - include subsidiary, business unit, division, and entity-level. The COSO ERM framework contains eight risk components: ✑ Internal Environment ✑ Objective Settings ✑ Event Identification ✑ Risk Assessment ✑ Risk Response ✑ Control Activities ✑ Information and Communication ✑ Monitoring Section 404 of the Sarbanes-Oley act specifies a three dimensional model- COSO ERM, comprised of Internal control components, Internal control objectives, and organization entities. All the items listed are components except Financial reporting which is an internal control objective. Incorrect Answers: A, C, D: They are the Internal control components, not the Internal control objectives.

   Source: Adapted from community discussion — maheshexam

   Next question

6. Question 716 · 1449 in bank

   You are the project manager of a HGT project that has recently finished the final compilation process. The project customer has signed off on the project completion and you have to do few administrative closure activities. In the project, there were several large risks that could have wrecked the project but you and your project team found some new methods to resolve the risks without affecting the project costs or project completion date. What should you do with the risk responses that you have identified during the project's monitoring and controlling process?

   • AInclude the responses in the project management plan.
   • BInclude the risk responses in the risk management plan.
   • CInclude the risk responses in the organization's lessons learned database.
   • DNothing. The risk responses are included in the project's risk register already.

   Show answer

   Answer: C

   Explanation

   The risk responses that do not exist up till then, should be included in the organization's lessons learned database so other project managers can use these responses in their project if relevant. Incorrect Answers: A: The responses are not in the project management plan, but in the risk response plan during the project and they'll be entered into the organization's lessons learned database. B: The risk responses are included in the risk response plan, but after completing the project, they should be entered into the organization's lessons learned database. D: If the new responses that were identified is only included in the project's risk register then it may not be shared with project managers working on some other project.

   Source: Adapted from community discussion — Ifyalfred

   Next question

7. Question 717 · 1449 in bank

   Which of the following is NOT true for risk management capability maturity level 1?

   • AThere is an understanding that risk is important and needs to be managed, but it is viewed as a technical issue and the business primarily considers the downside of IT risk
   • BDecisions involving risk lack credible information
   • CRisk appetite and tolerance are applied only during episodic risk assessments
   • DRisk management skills exist on an ad hoc basis, but are not actively developed

   Show answer

   Answer: A

   Explanation

   The Risk Management Capability Maturity Level 1 (CML 1) refers to an initial level of risk management maturity, characterized by an ad hoc, reactive approach to risk management. In CML1: Decisions involving risk lack credible information Risk appetite and tolerance are applied only during episodic risk assessments Risk management skills exist on an ad hoc basis, but are not actively developed. In CML1, risk management is not typically viewed as a strategic business issue, but rather as a technical issue, and the focus is mainly on the downside of IT risks. This level is characterized by a lack of structure, governance, and process, and by a reactive approach to risk management. The risks are usually identified and managed on an ad-hoc basis, with no clear risk management strategy or governance in place.

   Source: Adapted from community discussion — mfourati

   Next question

8. Question 718 · 1449 in bank

   Who is at the BEST authority to develop the priorities and identify what risks and impacts would occur if there were loss of the organization's private information?

   • AExternal regulatory agencies
   • BInternal auditor
   • CBusiness process owners
   • DSecurity management

   Show answer

   Answer: C

   Explanation

   This answer is not in keeping with the ISACA view that the process owner (business) classifies and outlines the controls required.

   Source: Adapted from community discussion — jfarrelly

   Next question

9. Question 719 · 1449 in bank

   You work as a project manager for BlueWell Inc. You are about to complete the quantitative risk analysis process for your project. You can use three available tools and techniques to complete this process. Which one of the following is NOT a tool or technique that is appropriate for the quantitative risk analysis process?

   • AData gathering and representation techniques
   • BExpert judgment
   • CQuantitative risk analysis and modeling techniques
   • DOrganizational process assets

   Show answer

   Answer: D

   Explanation

   Organizational process asset is not a tool and technique, but an input to the quantitative risk analysis process. Quantitative Risk Analysis is a process to assess the probability of achieving particular project objectives, to quantify the effect of risks on the whole project objective, and to prioritize the risks based on the impact to overall project risk. Quantitative Risk Analysis process analyzes the affect of a risk event deriving a numerical value. It also presents a quantitative approach to build decisions in the presence of uncertainty. The inputs for Quantitative Risk Analysis are: ✑ Organizational process assets ✑ Project Scope Statement ✑ Risk Management Plan ✑ Risk Register Project Management Plan - Incorrect Answers: A: Data gathering and representation technique is a tool and technique for the quantitative risk analysis process. B: Expert judgment is a tool and technique for the quantitative risk analysis process. C: Quantitative risk analysis and modeling techniques is a tool and technique for the quantitative risk analysis process.

   

   Next question

10. Question 720 · 1449 in bank

    You are the project manager of project for a client. The client has promised your company a bonus, if the project is completed early. After studying the project work, you elect to crash the project in order to realize the early end date. This is an example of what type of risk response?

    • ANegative risk response, because crashing will add risks.
    • BPositive risk response, as crashing is an example of enhancing.
    • CPositive risk response, as crashing is an example of exploiting.
    • DNegative risk response, because crashing will add costs.

    Show answer

    Answer: C

    Explanation

    The plausible correct is answer C. Exploiting is about doing everything to ensure that the event happens. In this risk response strategy, you make sure you realize the opportunity. Simply put, with the exploit risk response strategy, you increase the chance of the event happening to 100%. https://pmstudycircle.com/enhance-risk-response-vs-exploit-risk-response-strategies/

    Source: Adapted from community discussion — Bertolini

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 711. 1449 questions available.