QUESTION: 213

Which among the following is the MOST crucial part of risk management process?

Risk communication
Auditing
Risk monitoring
Risk mitigation

Answer(s): A

Explanation:

Risk communication is a critical part in the risk management process. People are naturally uncomfortable talking about risk and tend to put off admitting that risk is involved and communicating about issues; incidents; and; eventually, even crises.

If risk is to be managed and mitigated, it must first be discussed and effectively communicated throughout an enterprise.

Incorrect Answers:
B: Auditing is done to test the overall risk management process and the planned risk responses. So it is the very last phase after completion of risk management process.

C: Risk monitoring is the last phase to complete risk management process, and for proper management of risk it should be communicated properly. Hence risk communication is the most crucial step.

D: Risk mitigation is one of the phases of risk management process for effective mitigation of risk it should be first communicated throughout an enterprise.

Reveal Solution Next Question

QUESTION: 214

Which of the following is a key component of strong internal control environment?

RMIS
Segregation of duties
Manual control
Automated tools

Answer(s): B

Explanation:

Segregation of duties (SOD) is a key component to maintaining a strong internal control environment because it reduces the risk of fraudulent transactions. When duties for a business process or transaction are segregated it becomes more difficult for fraudulent activity to occur because it would involve collusion among several employees.

Incorrect Answers:
A: An RMIS can be a very effective tool in monitoring all risk factors that impact the enterprise. The danger is that many important classes of risk may be omitted from consideration by the system. hence it doesn't ensure strong internal control environment.

C: Manual controls usually not form strong internal control environment. By not automating SOD controls, there is, potentially, the issue of these controls becoming a barrier in serving the customer. As manual authorizations are often time consuming and require another step in any business process, this takes time away from serving the customer.

Automated compliance solutions aim to provide enterprises with timely and efficient internal controls that do not disrupt their normal business process.

D: It is not directly related in maintaining strong internal control environment. The automated tools are typically used to address SOD and also to provide the enterprise with reporting functionality on SOD violations (i.e., detective controls) and to put in place preventive controls.

Reveal Solution Next Question

QUESTION: 215

You are the project manager of the NKJ Project for your company. The project's success or failure will have a significant impact on your organization's profitability for the coming year. Management has asked you to identify the risk events and communicate the event's probability and impact as early as possible in the project.
Management wants to avoid risk events and needs to analyze the cost-benefits of each risk event in this project. What term is assigned to the low-level of stakeholder tolerance in this project?

Mitigation-ready project management
Risk avoidance
Risk utility function
Risk-reward mentality

Answer(s): C

Explanation:

Risk utility function is assigned to the low-level of stakeholder tolerance in this project.

The risk utility function describes a person's or organization's willingness to accept risk. It is synonymous with stakeholder tolerance to risk.

Risk utility function facilitates the selection and acceptance of risk and provides opportunity to merge the approach with setting thresholds of risk acceptability and using utility-risk ratios if necessary.

Incorrect Answers:
A: This is not a valid project management and risk management term. B: Risk avoidance is a risk response to avoid negative risk events.
D: Risk-reward describes the balance between accepting risks and the expected reward for the risk event. Risk-reward mentality is not a valid project management term.

Reveal Solution Next Question

QUESTION: 216

How residual risk can be determined?

By determining remaining vulnerabilities after countermeasures are in place.
By transferring all risks.
By threat analysis
By risk assessment

Answer(s): A

Reveal Solution Next Question

Free CRISC Exam Braindumps (page: 54)

QUESTION: 213

Explanation:

QUESTION: 214

Explanation:

QUESTION: 215

Explanation:

QUESTION: 216