Governance Framework CRISC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a centralized organizational structure, how are risk and control responsibilities typically assigned?

   • ARisk and control decisions are concentrated at the corporate or central level, with limited autonomy for business units.
   • BRisk responsibilities are outsourced to external auditors.
   • CEach business unit independently sets its own risk appetite and control standards.
   • DRisk and control responsibilities are shared equally among all employees with no formal hierarchy.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization's policy requires that all access to customer data be logged and reviewed. The IT team is unsure how often to review the logs. What should they consult?

   • AThe risk register
   • BThe organization's mission statement
   • CThe audit committee
   • DA standard that specifies review frequency
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A multinational corporation operates with a matrix structure where regional managers report to both regional directors and global functional heads. A new IT risk policy is being rolled out. Which group is BEST positioned to ensure consistent implementation across all regions?

   • AIndividual project managers
   • BExternal auditors
   • CGlobal functional heads
   • DRegional directors
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An organization has a policy that all data must be classified before storage. However, employees often skip classification because it is time-consuming. The policy is not being followed, and the risk of data leakage is increasing. What is the MOST EFFECTIVE way to improve compliance?

   • AStrengthen the policy by adding more detailed requirements
   • BAutomate data classification using technical tools
   • CConduct regular training on the importance of classification
   • DDiscipline employees who do not classify data
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A global company is transitioning from a centralized to a federated governance model. Business units will gain more autonomy, but the enterprise risk team must still ensure compliance with corporate policies. What is the MOST EFFECTIVE way to maintain control while granting autonomy?

   • AMaintain all risk decisions at the corporate level
   • BAppoint a risk officer in each business unit with full authority
   • CDefine enterprise-wide risk standards and require business units to implement them locally
   • DAllow each business unit to create its own risk policies
   Reveal Solution Discussion Select an answer first