A risk assessment identifies a new risk that is rated as 'extreme' and exceeds the organization's risk appetite. The risk owner has been assigned. What is the most important immediate action for the risk manager?

Develop a detailed risk treatment plan before adding it to the register.

Inform the board of directors directly and bypass the risk owner.

Add the risk to the risk register and escalate it to senior management.

Wait for the next risk committee meeting to discuss the risk.

What is the purpose of compliance monitoring in the context of risk management?

To replace the need for risk assessments

To identify new business opportunities

To ensure adherence to risk management policies, standards, and regulatory requirements

To eliminate all regulatory requirements

What is the purpose of a risk escalation process?

To automatically resolve all risks without management involvement

To assign blame for risk-related failures

To delay reporting of risks until the next scheduled review

To bring significant risk changes to the attention of appropriate management levels

What is a common dashboard technique for presenting risk status?

Using color-coded indicators such as red, yellow, and green

Using only raw numerical data without labels

Using only pie charts for all data

A global bank has a risk appetite that allows a maximum of 5% of high-value transactions to be flagged for manual review. The current KRI shows this has risen to 7% over the past week. The risk owner is on vacation. The CISO must decide the next step. Which action is most appropriate?

Wait for the risk owner to return and address the issue.

Temporarily adjust the risk appetite to 7% to avoid escalation.

Send an email to the risk owner and wait for a response.

Escalate the breach to the next level of management with a recommended action plan.

Certified Information Security Manager

Domain 2Objective 6

Risk Monitoring and Reporting CISM Practice Questions (Page 4)

Part of the Domain 2: Information Security Risk Management domain, which accounts for 20% of the CISM exam.

37questions here

8free pages

9concepts

20%of the exam

Questions 16–20

16application · medium
A risk assessment identifies a new risk that is rated as 'extreme' and exceeds the organization's risk appetite. The risk owner has been assigned. What is the most important immediate action for the risk manager?
Select an answer first
17foundation · easy
What is the purpose of compliance monitoring in the context of risk management?
Select an answer first
18foundation · easy
What is the purpose of a risk escalation process?
Select an answer first
19foundation · easy
What is a common dashboard technique for presenting risk status?
Select an answer first
20expert · hard
A global bank has a risk appetite that allows a maximum of 5% of high-value transactions to be flagged for manual review. The current KRI shows this has risen to 7% over the past week. The risk owner is on vacation. The CISO must decide the next step. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.