Risk and Control Ownership CISM Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational corporation has a risk owner for a critical data breach risk. The risk owner is the head of the IT department. The risk is related to a business process owned by the marketing department. The marketing department has implemented controls, but the risk owner has no authority over the marketing department's budget or processes. The risk remains high. What is the most effective solution?

   • AReassign the risk to the head of the marketing department, who has authority over the process.
   • BAccept the risk because the risk owner cannot influence the marketing department.
   • CKeep the IT head as the risk owner and require marketing to report to IT.
   • DAssign the risk to the CISO, who has authority over all security risks.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does control ownership integrate into the risk management lifecycle after a risk treatment decision is made?

   • AControl owners are assigned to implement and operate the controls selected to mitigate the risk
   • BControl owners are responsible for approving the risk treatment plan
   • CControl owners are responsible for reassessing the risk annually
   • DControl owners are responsible for communicating the risk to the board
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A project manager is responsible for implementing a new security control. The project manager has completed the implementation and handed the control over to the IT operations team. The IT operations team is now responsible for maintaining the control. Who is accountable for the control's ongoing effectiveness?

   • AThe control owner, because accountability for the control's effectiveness rests with this role.
   • BThe IT operations team, because they are now responsible for maintaining the control.
   • CThe CISO, because all security controls are ultimately the CISO's responsibility.
   • DThe project manager, because they implemented the control.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A risk owner delegates the daily monitoring of a control to a system administrator. Which statement is true regarding accountability and responsibility in this scenario?

   • AThe risk owner is no longer responsible for the risk, and the system administrator becomes accountable
   • BThe risk owner remains accountable for the risk, while the system administrator is responsible for the monitoring task
   • CBoth the risk owner and the system administrator become jointly accountable for the risk
   • DThe system administrator becomes accountable for the risk, and the risk owner is no longer accountable
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A manufacturing company has a risk owner for its supply-chain disruption risk. The risk owner has delegated the day-to-day monitoring of supplier security assessments to a junior analyst. The analyst performs the assessments and reports findings. A significant supplier risk is missed, and the company suffers a disruption. Who is ultimately accountable for the failure to manage this risk?

   • AThe risk owner, because accountability cannot be delegated.
   • BThe junior analyst, because they performed the assessments and missed the risk.
   • CThe supplier, because they failed to meet security requirements.
   • DThe CISO, because information security risk management is the CISO's domain.
   Reveal Solution Discussion Select an answer first