Governance Framework CRISC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which role is primarily responsible for setting the enterprise's risk appetite and overseeing the risk management framework?

   • AInternal audit
   • BChief Information Officer (CIO)
   • CRisk owner
   • DBoard of directors
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization has a policy that requires all employees to report security incidents. The policy is broad, but the IT team needs to know exactly what constitutes an incident and how to report it. What should the IT team create?

   • AA guideline
   • BA risk register
   • CA procedure
   • DA standard
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How does a decentralized organizational structure influence risk and control responsibilities?

   • ARisk responsibilities are eliminated because the structure is inherently low-risk.
   • BBusiness units have greater autonomy to manage their own risks and implement controls tailored to their operations.
   • CAll risk decisions are made by a single central risk committee.
   • DControls are standardized across all units with no local variation.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company's leadership team is known for making decisions quickly without consulting risk management. This has led to several projects exceeding risk thresholds. What is the MOST EFFECTIVE way to embed risk awareness into decision-making?

   • AIncrease the risk appetite to accommodate the decisions
   • BIntegrate risk assessment into the project approval process
   • CPublish a risk policy and expect employees to read it
   • DConduct a one-time risk training session
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary responsibility of a risk owner in an organization?

   • ATo approve all IT system changes
   • BTo manage and monitor a specific risk and implement appropriate responses
   • CTo set the overall risk appetite for the enterprise
   • DTo audit the effectiveness of risk management processes
   Reveal Solution Discussion Select an answer first