A company has a decentralized IT structure where each business unit manages its own IT risks. The board wants to centralize risk reporting without disrupting business unit operations. What is the best approach to integrate risk management across the organization?

Replace all business unit risk processes with a single enterprise-wide framework.

Implement a common risk taxonomy and require all business units to report risks using a standardized format.

Use NIST RMF as the sole framework for all business units.

Keep business unit risk processes separate and have the board review each unit's report independently.

A global retail company operates in multiple jurisdictions with varying data protection laws. The board wants a single risk framework that can be applied consistently across all regions while still allowing local compliance teams to address specific regulatory requirements. What is the best approach?

Adopt ISO/IEC 27005 as the global framework and ignore local regulatory differences.

Adopt ISO 31000 as the global umbrella framework and allow regional teams to use local standards for detailed assessments.

Adopt COSO ERM globally and prohibit regional variations to ensure consistency.

Adopt NIST RMF globally and require all regions to use the same control catalog.

A bank is required by its regulator to conduct an operational risk assessment that includes scenario analysis and capital calculation. The IT risk team also needs to assess cyber risks. Which combination of frameworks/standards should the bank use?

Use ISO 31000 for capital calculation and NIST RMF for cyber risk.

Use NIST RMF for both operational and cyber risk assessment.

Use COSO ERM for cyber risk and Basel for operational risk.

Use Basel operational risk principles for capital calculation and ISO/IEC 27005 for cyber risk assessment.

Certified in the Governance of Enterprise IT

Domain 4Objective 1

Risk Frameworks and Standards CGEIT Practice Questions (Page 5)

Part of the Risk Optimization domain, which accounts for 19% of the CGEIT exam.

23questions here

5free pages

5concepts

19%of the exam

Questions 21–23

21expert · hard
A company has a decentralized IT structure where each business unit manages its own IT risks. The board wants to centralize risk reporting without disrupting business unit operations. What is the best approach to integrate risk management across the organization?
Select an answer first
22expert · hard
A global retail company operates in multiple jurisdictions with varying data protection laws. The board wants a single risk framework that can be applied consistently across all regions while still allowing local compliance teams to address specific regulatory requirements. What is the best approach?
Select an answer first
23application · medium
A bank is required by its regulator to conduct an operational risk assessment that includes scenario analysis and capital calculation. The IT risk team also needs to assess cyber risks. Which combination of frameworks/standards should the bank use?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CGEIT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CGEIT” is a trademark of its owner, used for identification only.

Risk Frameworks and Standards CGEIT Practice Questions (Page 5)

Questions 21–23

A company has a decentralized IT structure where each business unit manages its own IT risks. The board wants to centralize risk reporting without disrupting business unit operations. What is the best approach to integrate risk management across the organization?

A bank is required by its regulator to conduct an operational risk assessment that includes scenario analysis and capital calculation. The IT risk team also needs to assess cyber risks. Which combination of frameworks/standards should the bank use?

Keep studying — Risk Optimization