In an organization where each division manages risk independently, which of the following would BEST enable management of risk at the enterprise level?
Answer(s): A
A standardized risk taxonomy is a common language and structure for identifying, analyzing, and reporting risks across the enterprise. It enables consistent and comparable risk assessment and aggregation, as well as clear communication and coordination among different divisions. A list of control deficiencies, an enterprise risk ownership policy, and an updated risk tolerance metric are not sufficient to enable management of risk at the enterprise level, as they do not address the issue of risk alignment and integration among divisions. References = [CRISC Review Manual (Digital Version)], page 42; CRISC by Isaca Actual Free Exam Q&As, question 197.
Reviewing historical risk events is MOST useful for which of the following processes within the risk management life cycle?
Answer(s): D
Reviewing historical risk events is most useful for the risk assessment process within the risk management life cycle. Risk assessment is the process of identifying, analyzing, and evaluating the risks that may affect the project or the organization1. Reviewing historical risk events can help to:Identify the sources, causes, and consequences of past risks and learn from the successes and failures of previous projects or organizationsAnalyze the likelihood and impact of potential risks based on historical data and trends, and use statistical methods or models to estimate the probability and severity of risk scenarios Evaluate the level of risk exposure and compare it with the risk appetite and tolerance of the project or the organization, and prioritize the risks that need further attention or action Use historical risk events as inputs or examples for risk identification and analysis techniques, such as brainstorming, checklists, interviews, surveys, SWOT analysis, root cause analysis, or Monte Carlo simulation2References = Risk and Information Systems Control Study Manual, Chapter 5: Risk Assessment Process3
To mitigate the risk of using a spreadsheet to analyze financial data, IT has engaged a third- party vendor to deploy a standard application to automate the process. Which of the following parties should own the risk associated with calculation errors?
According to the CRISC Review Manual1, the business owner is the person who has the authority and accountability for the achievement of the business objectives and the managementof the associated risks. The business owner is ultimately responsible for ensuring that the IT services and solutions support the business needs and goals, and for accepting or rejecting the residual risks after the implementation of risk responses. Therefore, the business owner should own the risk associated with calculation errors, as they are the ones who will be affected by the potential impact of the errors on the financial data and decisions. References = CRISC Review Manual1, page 194.
Which of the following is the MOST relevant information to include in a risk management strategy?
The most relevant information to include in a risk management strategy is the organizational goals, because they provide the direction and purpose for the risk management activities. A risk managementstrategy is a document that outlines the objectives, scope, approach, roles, and responsibilities for managing risks in an organization. A risk management strategy should align with the organizational goals, which are the desired outcomes or results that the organization wants to achieve. The organizational goals should be specific, measurable, achievable, relevant, and time-bound (SMART), and they should reflect the organization's vision, mission, values, and strategy. By including the organizational goals in the risk management strategy, the risk practitioner can ensure that the risk management process supports and enables the achievement of the organizational goals. The risk practitioner can also use the organizational goals as a basis for identifying, assessing, prioritizing, and responding to the risks that may affect theorganization's performance and success. The risk practitioner can also monitor and measure the progress and effectiveness of the risk management process by comparing the actual results with the expected results based on the organizational goals. Therefore, the organizational goals are themost relevant information to include in a risk management strategy, as they provide the foundation and framework for the risk management process. References = Risk and Information Systems Control StudyManual, Chapter 1: IT Risk Identification, Section 1.1: IT Risk Management Strategy, pp. 3-
Which of the following is the MOST important consideration when prioritizing risk response?
Answer(s): C
The effectiveness of risk treatment determines whether the selected response sufficiently mitigates the identified risk. This consideration ensures alignment with risk appetite and reduces residual risk to acceptable levels, reflecting the priorities set out in theRisk Response and Treatmentdomain of CRISC.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.