Risk and Control Ownership CISM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In an organization's information security risk management program, which individual is ultimately accountable for ensuring that a specific risk is managed to an acceptable level?

   • AThe risk owner, who has the authority to accept, mitigate, or transfer the risk
   • BThe internal auditor, who independently evaluates the effectiveness of risk management
   • CThe chief information security officer (CISO), who oversees the entire security program
   • DThe control owner, who implements and operates the controls that mitigate the risk
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which activity is most directly associated with a control owner's role?

   • AConducting a forensic investigation after a security incident
   • BDetermining the risk tolerance for a specific business unit
   • CMonitoring the effectiveness of a control and reporting on its status
   • DApproving the organization's information security policy
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization has implemented a new access-control system. The IT operations manager is responsible for configuring user permissions and maintaining the system daily. The compliance officer is accountable for ensuring the system meets regulatory requirements. During an audit, a reviewer asks who is responsible for the control. Which individual should the reviewer identify as the control owner?

   • AThe IT operations manager, because this role implements and maintains the control on a daily basis.
   • BThe compliance officer, because accountability for regulatory compliance rests with this role.
   • CThe CISO, because information security controls ultimately fall under this executive role.
   • DBoth the compliance officer and the IT operations manager, because they share equal responsibility.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In the context of risk and control ownership, how does accountability differ from responsibility?

   • AAccountability can be delegated, while responsibility cannot be delegated
   • BAccountability is the obligation to answer for outcomes, while responsibility is the duty to perform tasks
   • CAccountability is a technical concept, while responsibility is a managerial concept
   • DAccountability is assigned to a team, while responsibility is assigned to an individual
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the first step in assigning risk ownership to an appropriate individual?

   • AConducting a cost-benefit analysis of potential controls
   • BIdentifying the risk and determining which business area is most affected
   • CSelecting the control owner for the risk mitigation controls
   • DObtaining approval from the board of directors for the assignment
   Reveal Solution Discussion Select an answer first