Risk Appetite and Risk Tolerance CGEIT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How do risk appetite and risk tolerance relate to each other?

   • ARisk appetite is the acceptable deviation from risk tolerance
   • BRisk tolerance is the acceptable deviation from risk appetite
   • CThey are synonymous terms used interchangeably
   • DThey are independent concepts with no relationship
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has a risk appetite statement that says it is willing to accept 'moderate' operational risk. The board has set a risk tolerance for the IT department of a maximum of 4 hours of downtime per month. In the last month, the IT department experienced 6 hours of downtime due to a ransomware attack. The company's risk management team is debating the appropriate response. Which of the following is the most appropriate?

   • AIgnore the breach because the overall risk appetite is still moderate.
   • BTreat the breach as a signal that the risk tolerance may be too low for the current threat environment, and review the tolerance in light of the incident.
   • CIncrease the risk tolerance to 6 hours to match the actual downtime.
   • DImmediately fire the IT manager responsible for the downtime.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A healthcare organization is establishing its risk appetite for patient data privacy. The organization wants to balance the need for innovation with strict regulatory requirements. Which of the following is the most appropriate approach?

   • ASet a high risk appetite for privacy to encourage innovation, and address any breaches as they occur.
   • BSet the risk appetite based on the preferences of the IT department, as they are most familiar with the technology.
   • CSet a very low risk appetite for privacy to ensure full compliance, even if it limits innovation.
   • DSet a moderate risk appetite that allows for calculated risks in innovation, while establishing strict tolerances for privacy breaches.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which event would most likely trigger a review of the organization's risk appetite?

   • AThe appointment of a new IT helpdesk employee
   • BA significant change in the organization's strategic direction
   • CA routine monthly financial report
   • DA change in the color of the corporate logo
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A global bank has defined its risk appetite for operational risk as 'low'. To ensure that all branches and business units adhere to this appetite, the bank wants to communicate it effectively. Which of the following is the most effective communication method?

   • APost the risk appetite statement on the company's internal website.
   • BInclude the risk appetite statement in the employee handbook and require a signature upon hire.
   • CSend a memo to all employees explaining the risk appetite.
   • DDevelop a risk appetite framework that includes clear examples and decision-making criteria, and train managers on how to apply it.
   Reveal Solution Discussion Select an answer first