A new risk has been identified in a company's customer data handling process. The risk owner has been assigned, but the risk owner is unsure which controls are already in place. What should the risk owner do first?

Review the existing controls and their effectiveness with the control owners.

Accept the risk because controls may already exist.

Transfer the risk to the control owners because they manage the controls.

Immediately implement a new control to mitigate the risk.

Which factor is most important when assigning control ownership?

The individual's familiarity with the risk owner

The individual's seniority in the organization

The individual's availability to attend risk committee meetings

The individual's proximity to the control and ability to operate it

Which type of information should a control owner include when reporting on control effectiveness to stakeholders?

The results of control testing and any identified deficiencies

The organization's strategic business plan

The names of all employees who have access to the control

The personal performance reviews of the control owner

A risk owner needs to report the status of a high-risk item to the executive committee. The risk has been mitigated, but residual risk remains. What is the most appropriate information for the risk owner to include in the report?

The current risk level, the residual risk, and the effectiveness of the mitigation.

The technical details of the mitigation control and its configuration.

The risk owner's personal opinion on whether the risk is acceptable.

The names of the control owners and their daily responsibilities.

A company is implementing a new risk management framework. The CISO must assign ownership for a risk that spans multiple business units. The risk affects the finance, HR, and IT departments. Which approach is most appropriate for assigning ownership?

Assign multiple risk owners, one from each affected department.

Assign a risk owner from the executive level who has authority over all affected departments.

Assign the risk to the CISO because they have authority over all security risks.

Assign a single risk owner from the department most affected by the risk.

Certified Information Security Manager

Domain 2Objective 5

Risk and Control Ownership CISM Practice Questions (Page 4)

Part of the Domain 2: Information Security Risk Management domain, which accounts for 20% of the CISM exam.

24questions here

5free pages

6concepts

20%of the exam

Questions 16–20

16application · medium
A new risk has been identified in a company's customer data handling process. The risk owner has been assigned, but the risk owner is unsure which controls are already in place. What should the risk owner do first?
Select an answer first
17foundation · easy
Which factor is most important when assigning control ownership?
Select an answer first
18foundation · easy
Which type of information should a control owner include when reporting on control effectiveness to stakeholders?
Select an answer first
19application · medium
A risk owner needs to report the status of a high-risk item to the executive committee. The risk has been mitigated, but residual risk remains. What is the most appropriate information for the risk owner to include in the report?
Select an answer first
20expert · hard
A company is implementing a new risk management framework. The CISO must assign ownership for a risk that spans multiple business units. The risk affects the finance, HR, and IT departments. Which approach is most appropriate for assigning ownership?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.