Which method is commonly used to communicate risk appetite and tolerance to stakeholders?

Keeping risk appetite confidential to avoid scrutiny

Using technical jargon to ensure precision

Publishing a risk appetite statement in the organization's policies

Communicating only to the board and senior management

A company has had the same risk appetite statement for several years, but the external environment has changed significantly, including new regulations and market conditions. The board is considering whether to update the risk appetite. Which of the following is the most appropriate approach?

Conduct a comprehensive review of the risk appetite, considering the new regulations, market conditions, and the company's strategic objectives.

Update the risk appetite only if the company has experienced significant losses.

Delegate the review of the risk appetite to the risk management department and accept their recommendations without board approval.

Keep the risk appetite unchanged to maintain stability and avoid confusion.

Which input is most important when establishing an organization's risk appetite?

The organization's strategic objectives

The personal risk preferences of the CEO

The risk appetite of the industry association

The risk management software used by the organization

Why is it important to monitor and review risk appetite and tolerance over time?

To ensure they remain appropriate as the organization's objectives and environment change

To keep them static and avoid changes

To satisfy external auditors only

To reduce the risk appetite to zero

A company has set its risk appetite for compliance risk as 'very low'. The board is now setting risk tolerance levels for different compliance areas. Which of the following is the most appropriate way to set these tolerances?

Set moderate tolerances for all compliance areas to allow some flexibility.

Set very strict tolerances for all compliance areas to reflect the low appetite.

Set tolerances based on the ease of compliance for each area.

Set tolerances based on the potential financial impact of each compliance area.

Certified in the Governance of Enterprise IT

Domain 4Objective 3

Risk Appetite and Risk Tolerance CGEIT Practice Questions (Page 3)

Part of the Risk Optimization domain, which accounts for 19% of the CGEIT exam.

26questions here

6free pages

7concepts

19%of the exam

Questions 11–15

11foundation · easy
Which method is commonly used to communicate risk appetite and tolerance to stakeholders?
Select an answer first
12expert · hard
A company has had the same risk appetite statement for several years, but the external environment has changed significantly, including new regulations and market conditions. The board is considering whether to update the risk appetite. Which of the following is the most appropriate approach?
Select an answer first
13foundation · easy
Which input is most important when establishing an organization's risk appetite?
Select an answer first
14foundation · easy
Why is it important to monitor and review risk appetite and tolerance over time?
Select an answer first
15application · medium
A company has set its risk appetite for compliance risk as 'very low'. The board is now setting risk tolerance levels for different compliance areas. Which of the following is the most appropriate way to set these tolerances?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CGEIT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CGEIT” is a trademark of its owner, used for identification only.