Risk Management ACCISO Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A regional bank must align its risk management program with a framework that emphasizes internal control and is widely accepted by external auditors. The bank's board wants a framework that integrates risk with strategy and performance, not just a technical standard. Which framework should the bank adopt?

   • AISO 31000
   • BCOSO ERM
   • CCOBIT 2019
   • DNIST RMF
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A risk manager must present the quarterly risk report to the board of directors. The board is primarily interested in understanding which risks could affect strategic objectives and whether the organization is operating within its risk appetite. Which type of report would best meet the board's needs?

   • AA heat map showing risks by likelihood and impact, with a summary of top risks and their alignment to risk appetite.
   • BA compliance checklist indicating which regulations are met.
   • CA detailed technical vulnerability report listing all CVEs and patch statuses.
   • DA list of all risk treatments implemented in the quarter with cost details.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company's risk management program is failing because business units do not report risks in a timely manner. The board wants to improve risk reporting and accountability. Which action would most effectively improve risk governance and culture?

   • AProvide additional training on risk identification.
   • BEstablish a risk committee with representatives from each business unit and define clear risk ownership.
   • CMandate that all risks be reported to the CISO within 24 hours.
   • DImplement a new risk management software tool to automate reporting.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A global company must comply with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). The risk team is prioritizing compliance risks. Which approach best integrates risk management with compliance obligations?

   • AFocus only on GDPR because it has higher fines than CCPA.
   • BTreat all compliance requirements as equal and implement a single set of controls for both regulations.
   • CImplement all possible controls to ensure compliance with both regulations regardless of cost.
   • DAssess the likelihood and impact of non-compliance for each regulation and prioritize controls based on the highest risk.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company faces a risk of a data breach that could result in regulatory fines. The company has three options: (1) implement strong encryption (cost $200,000, reduces likelihood by 80%), (2) purchase cyber insurance (premium $150,000, covers 90% of losses), or (3) do nothing. The risk analysis shows a 15% probability of a $2 million loss. Which option is the most cost-effective?

   • ABoth encryption and insurance are equally cost-effective
   • BDo nothing, because the ALE is only $300,000
   • CPurchase insurance, because it reduces the ALE to $30,000
   • DImplement encryption, because it reduces the ALE to $60,000
   Reveal Solution Discussion Select an answer first