Enterprise Risk Management CGEIT Practice Questions (Page 3)

Questions 11–14

1. 11foundation · easy

   Which of the following is a key component of the ISO 31000 risk management framework?

   • AA certification scheme for IT governance professionals.
   • BA set of mandatory risk assessment tools that must be used for all decisions.
   • CA process for establishing the context, assessing risks, treating risks, and monitoring and reviewing.
   • DA detailed list of IT controls to mitigate cyber risks.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of evaluating risks during risk analysis?

   • ATo document all risks in a risk register for audit purposes.
   • BTo eliminate all risks from the enterprise.
   • CTo assign a financial value to every risk in the enterprise.
   • DTo compare the level of risk against risk criteria and prioritize risks for treatment.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   During IT risk identification, which of the following is a strategic risk?

   • AThe risk that a new technology investment fails to deliver the expected competitive advantage.
   • BThe risk of a data breach due to weak access controls.
   • CThe risk of a server outage due to a power failure.
   • DThe risk of non-compliance with tax regulations.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does enterprise risk management (ERM) integrate with strategy setting in an organization?

   • AERM is applied only after a strategy is implemented, to monitor risks.
   • BERM is used to evaluate risks associated with strategic alternatives and inform the selection of strategy.
   • CERM is focused solely on financial risks and has no role in strategy.
   • DERM replaces the need for strategic planning.
   Reveal Solution Discussion Select an answer first