Which of the following is MOST influential when management makes risk response decisions?
Answer(s): A
According to the CRISC Review Manual1, risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite is the most influential factor when management makes risk response decisions, as it helps to define the boundaries and thresholds for acceptable risk levels, and to align the risk responses with the organization's strategy, goals, and culture. Risk appetite alsohelps to balance the potential benefits and costs of risk responses, and to communicate the risk expectations and preferences to the stakeholders. References = CRISC Review Manual1, page 192.
Which of the following risk register updates is MOST important for senior management to review?
Answer(s): C
A risk register is a document that records and tracks the information and status of the identified risks and their responses. It includes the risk description, category, source, cause, impact, probability, priority, response, owner, action plan, status, etc. A risk register update is a change or modification to the information or status of the risks and their responses in the risk register. It may be triggered by the occurrence or resolution of a risk event, the identification or evaluation of a new or emerging risk, the implementation or completion of a risk response, the monitoring or review of the risk performance, etc. The most important risk register update for senior management to review is avoiding a risk that was previously accepted, which means that the organization has decided to eliminate or withdraw from the risk exposure or activity that may cause the risk, instead of tolerating or retaining the risk as before. This may indicate a significant change in the organization's risk appetite, strategy, objectives, or environment, and it may have a major impact on the organization's performance and value.The other options are not the most important risk register updates for senior management to review, because they do not indicate a significant change or impact on the organization's risk profile or performance.Extending the date of a future action plan by two months means that the organization has postponed the implementation or completion of the planned actions or measures to address the risk, due to some reasons or constraints. This may indicate a delay or deviation from the expected or desired risk outcome, but it may not have a major impact on the organization's performance and value, unless the risk is very urgent or critical. Retiring a risk scenario no longer used means that the organization has removed or discarded the risk scenario that is no longer relevant or applicable to the organization's objectives or operations, due to some changes or developments. This may indicate a reduction or improvement in the organization's risk exposure or level, but it may not have a major impact on the organization's performance and value, unless the risk scenario was very significant or influential.Changing a risk owner means that the organization has assigned or transferred the responsibility and accountability for the risk and its response to a different person or role, due to some reasons or circumstances. This may indicate a change or improvement in the organization's risk governance or culture, but it may not have a major impact on the organization's performance and value, unless the risk owner was very ineffective or inappropriate. References =ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55, 58-59, 62-63ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 160 CRISC Practice Quiz and Exam Prep
The risk associated with data loss from a website which contains sensitive customer information is BEST owned by:
Answer(s): B
The risk associated with data loss from a website which contains sensitive customer information is best owned by the business process owner, as they are ultimately responsible for the business objectives and outcomes that depend on the website. The business process owner should ensure that the website is adequately protected and that the customer data is handled in compliance with the relevant laws and regulations. The third-party website manager, IT security, and the compliance manager are all involved in managing the risk, but they are not the owners. The third-party website manager is responsible for the technical aspects of the website, such as hosting, maintenance, and performance. IT security is responsible for implementing and monitoring the security controls and policies for the website. The compliance manager is responsible for ensuring that the website meets the regulatory and contractual requirements. However, none of these roles have the authority or accountability to own the risk, as they are not directly affected by the business impact of the data loss. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Identification, page 47.
Which stakeholders are PRIMARILY responsible for determining enterprise IT risk appetite?
Answer(s): D
The stakeholders who are PRIMARILY responsible for determining enterprise IT risk appetite are the executive management and the board of directors, because they are the ones who set thestrategic direction and objectives of the enterprise, and who define the acceptable level of risk exposure and tolerance for achieving those objectives. The other options are not the primary stakeholders, because:Option A: Audit and compliance management are responsible for providing assurance and oversight on the effectiveness of the risk management process and the compliance with internal and external requirements, but they do not determine the enterprise IT risk appetite. Option B: The CIO and the CFO are responsible for managing the IT resources and the financial resources of the enterprise, respectively, but they do not determine the enterprise IT risk appetite.Option C: Enterprise risk management and business process owners are responsible for identifying, assessing, and responding to the risks that affect their domains, but they do not determine the enterprise IT risk appetite. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 83.
Which of the following BEST supports ethical IT risk management practices?
Robust organizational communication channels are the best way to support ethical IT risk management practices, as they enable transparent and consistent sharing of risk information anddecisions among all stakeholders. Ethical IT risk management requires that the risk management process and outcomes are aligned with the enterprise's values, objectives, and obligations, and that the risk management activities are conducted with integrity, accountability, and respect. Robust organizational communication channels facilitate these aspects by ensuring that the risk management roles and responsibilities are clearly defined and communicated, that the risk management policies and procedures are widely disseminated and understood, that the risk management performance and results are regularly reported and reviewed, and that the risk management feedback and improvement suggestions are solicited and addressed. Mapping of key risk indicators (KRIs) to corporate strategy, capability maturity models integrated with risk management frameworks, and rigorously enforced operational service level agreements (SLAs) are not directly related to ethical IT risk management practices, but rather to the effectiveness and efficiency of the risk management process. References = CRISC Certified in Risk and Information Systems Control Question201; ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 201.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.