Enterprise Risk Management CGEIT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following best describes a quantitative risk analysis technique?

   • AUsing a risk matrix to plot likelihood against impact.
   • BUsing numerical values to estimate the probability and financial impact of a risk.
   • CRelying on expert judgment to rank risks in order of importance.
   • DAssigning a high, medium, or low rating to the likelihood and impact of a risk.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An organization has a risk appetite statement that says it will accept moderate risks to achieve growth. Which of the following best describes risk tolerance in this context?

   • AThe level of risk that is acceptable without any risk response.
   • BThe risk that must be avoided at all costs.
   • CThe maximum acceptable deviation from the stated risk appetite for a specific objective.
   • DThe total amount of risk the organization is willing to take across all projects.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of a key risk indicator (KRI) in risk monitoring?

   • ATo measure the financial performance of the IT department.
   • BTo provide an early warning signal that a risk may be increasing or changing.
   • CTo replace the need for regular risk assessments.
   • DTo document all risks in the risk register.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following best describes the primary purpose of the COSO ERM framework in the context of IT governance?

   • ATo define the exact risk tolerance thresholds for all IT-related risks.
   • BTo replace the need for internal audit by providing a comprehensive risk assessment methodology.
   • CTo prescribe specific IT security controls that must be implemented in every organization.
   • DTo provide a structured approach for integrating risk management with strategy and performance across the enterprise.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following best defines risk appetite in an enterprise context?

   • AThe total risk exposure calculated after implementing all risk responses.
   • BThe specific level of risk that triggers a mandatory risk response.
   • CThe risk that remains after management has implemented risk responses.
   • DThe maximum amount of risk an organization is willing to accept in pursuit of its objectives.
   Reveal Solution Discussion Select an answer first