In a decentralized organizational structure, each business unit has its own IT and risk management teams. A new regulation requires consistent risk reporting across the entire enterprise. What is the BEST approach to ensure consistency?

Establish enterprise-wide risk reporting standards and require all units to comply

Allow each unit to report in its own format

Appoint a single risk owner for the entire enterprise

Centralize all risk management functions immediately

What is the primary impact of organizational culture on risk appetite?

Culture is determined solely by the risk management framework.

Culture has no impact on risk appetite.

Culture shapes the organization's willingness to take risks and influences how risk decisions are made.

Culture only affects operational risks, not strategic risks.

A non-profit organization has a strategic goal to expand its services to a new region. The board is risk-averse and requires that any new initiative not jeopardize the organization's reputation. The executive director proposes a partnership with a local organization that has a mixed reputation. What is the BEST course of action?

Conduct a due diligence review of the partner and implement reputation risk controls

Proceed with the partnership without additional review to move quickly

Reject the partnership because of the partner's mixed reputation

Ask the partner to improve its reputation before partnering

A company has a flat organizational structure with few management layers. A new risk policy requires that all risk decisions be approved by a designated risk owner. However, employees are unsure who the risk owner is for their projects. What is the BEST way to resolve this ambiguity?

Define and communicate risk ownership for each project type in the policy

Have the CEO approve all risk decisions

Allow employees to make risk decisions independently

Create a new management layer to oversee risk decisions

Certified in Risk and Information Systems Control

Domain 1Objective 1

Governance Framework CRISC Practice Questions (Page 2)

Part of the Domain 1: Governance domain, which accounts for 26% of the CRISC exam.

27questions here

6free pages

5concepts

26%of the exam

Questions 6–10

6application · medium
An organization's policy states that 'all sensitive data must be encrypted.' The IT department is implementing encryption and needs specific technical requirements. What should the IT department use to define the exact encryption algorithms and key lengths?
Select an answer first
7application · medium
In a decentralized organizational structure, each business unit has its own IT and risk management teams. A new regulation requires consistent risk reporting across the entire enterprise. What is the BEST approach to ensure consistency?
Select an answer first
8foundation · easy
What is the primary impact of organizational culture on risk appetite?
Select an answer first
9expert · hard
A non-profit organization has a strategic goal to expand its services to a new region. The board is risk-averse and requires that any new initiative not jeopardize the organization's reputation. The executive director proposes a partnership with a local organization that has a mixed reputation. What is the BEST course of action?
Select an answer first
10expert · hard
A company has a flat organizational structure with few management layers. A new risk policy requires that all risk decisions be approved by a designated risk owner. However, employees are unsure who the risk owner is for their projects. What is the BEST way to resolve this ambiguity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CRISC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CRISC” is a trademark of its owner, used for identification only.

Governance Framework CRISC Practice Questions (Page 2)

Questions 6–10

An organization's policy states that 'all sensitive data must be encrypted.' The IT department is implementing encryption and needs specific technical requirements. What should the IT department use to define the exact encryption algorithms and key lengths?

In a decentralized organizational structure, each business unit has its own IT and risk management teams. A new regulation requires consistent risk reporting across the entire enterprise. What is the BEST approach to ensure consistency?

What is the primary impact of organizational culture on risk appetite?

A company has a flat organizational structure with few management layers. A new risk policy requires that all risk decisions be approved by a designated risk owner. However, employees are unsure who the risk owner is for their projects. What is the BEST way to resolve this ambiguity?

Keep studying — Domain 1: Governance