The PRIMARY objective of a risk management program is to:
Answer(s): D
The goal of a risk management program is to ensure that residual risk remains within manageable levels. Management of risk does not always require the removal of inherent risk nor is this always possible. A possible benefit of good risk management is to reduce insurance premiums, but this is not its primary intention.Effective controls are naturally a clear objective of a risk management program, but with the choices given, choice C is an incomplete answer.
After completing a full IT risk assessment, who can BEST decide which mitigating controls should be implemented?
Answer(s): B
The business manager will be in the best position, based on the risk assessment and mitigation proposals. to decide which controls should/could be implemented, in line with the business strategy and with budget. Senior management will have to ensure that the business manager has a clear understanding of the risk assessed but in no case will be in a position to decide on specific controls. The IT audit manager will take part in the process to identify threats and vulnerabilities, and to make recommendations for mitigations. The information security officer (ISO) could make some decisions regarding implementation of controls. However, the business manager will have a broader business view and full control over the budget and, therefore, will be in a better position to make strategic decisions.
When performing an information risk analysis, an information security manager should FIRST:
Answer(s): C
Assets must be inventoried before any of the other choices can be performed.
The PRIMARY benefit of performing an information asset classification is to:
All choices are benefits of information classification. However, identifying controls that are proportional to the risk in all cases is the primary benefit of the process.
Which of the following is MOST essential for a risk management program to be effective?
All of these procedures are essential for implementing risk management. However, without identifying new risks, other procedures will only be useful for a limited period.
Post your Comments and Discuss ISACA CISM exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CISM content, but please register or login to continue.