Risk and Control Ownership CISM Practice Questions (Page 5)

Questions 21–24

1. 21expert · hard

   A risk owner has delegated the responsibility for implementing a risk mitigation plan to a control owner. The control owner implements the plan, but the risk is not reduced to the expected level. The risk owner is held accountable by the board for the failure. Which statement best describes the accountability in this situation?

   • AThe board is accountable because they approved the risk management plan.
   • BBoth the risk owner and the control owner are equally accountable.
   • CThe risk owner is accountable because accountability cannot be delegated.
   • DThe control owner is accountable because they implemented the plan.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A large enterprise is restructuring its business units. As part of the restructuring, a risk owner for a critical operational risk is being moved to a new role. The risk is still relevant to the original business unit. What should the organization do to ensure the risk remains properly managed?

   • AFormally reassign the risk to a new owner within the original business unit.
   • BAssign the risk to the CISO temporarily until a new owner is identified.
   • CClose the risk because the original owner is no longer available.
   • DAllow the risk to remain unowned until the restructuring is complete.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A financial services firm is implementing a new risk management framework. The CISO needs to assign ownership for a newly identified risk related to third-party data processing. Which individual is the most appropriate risk owner for this risk?

   • AThe chief procurement officer, because they manage vendor contracts.
   • BThe head of the business unit that uses the third-party service, because they own the process and the budget.
   • CThe chief information security officer, because all information security risks are owned by the CISO.
   • DThe chief information officer, because they manage the technology infrastructure.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of risk and control owners communicating risk status to stakeholders?

   • ATo enable informed decision-making and oversight of risk management
   • BTo document all risk-related activities for regulatory compliance
   • CTo satisfy the requirements of external auditors
   • DTo assign blame when a risk materializes
   Reveal Solution Discussion Select an answer first